CISM · Question #366
An organization successfully responded to an information security incident. However, the information security manager learned that some of the steps specified in the incident management procedures…
The correct answer is B. Review the incident management procedures. The first step should be to review the incident management procedures to determine if they were unclear, outdated, or impractical. This ensures that the procedures are relevant and actionable, allowing for updates or clarifications before addressing other areas such as training…
Question
An organization successfully responded to an information security incident. However, the information security manager learned that some of the steps specified in the incident management procedures were not taken by the response team. What should be the information security manager's FIRST step?
Options
- AInterview the incident response team.
- BReview the incident management procedures.
- CProvide additional training to the incident response team.
- DRemove the steps from the incident management procedures.
How the community answered
(32 responses)- A19% (6)
- B72% (23)
- C3% (1)
- D6% (2)
Explanation
The first step should be to review the incident management procedures to determine if they were unclear, outdated, or impractical. This ensures that the procedures are relevant and actionable, allowing for updates or clarifications before addressing other areas such as training or team
Topics
Community Discussion
No community discussion yet for this question.