An incident response plan is being developed for servers hosting sensitive information. In the event of a breach, who should make the decision to shut down the system?

The correct answer is A. Service owner. The service owner should make the decision to shut down the system because they are accountable for the criticality and availability of the service. They have the authority to balance business impact against the need to contain and mitigate the incident.

Submitted by fernanda_arg· Apr 18, 2026Information Security Incident Management

Question

Options

AService owner
BOperations manager
CIncident response team
DInformation security manager

How the community answered

(23 responses)

A
70% (16)
B
4% (1)
C
9% (2)
D
17% (4)

Explanation

The service owner should make the decision to shut down the system because they are accountable for the criticality and availability of the service. They have the authority to balance business impact against the need to contain and mitigate the incident.

Topics

#Incident Response Plan#Roles and Responsibilities#Decision Making#Service Owner

Community Discussion

No community discussion yet for this question.

Full CISM Practice