Which of the following should a newly appointed information security manager do FIRST when evaluating the current incident notification and escalation processes?

Question

Options

• ATest current incident-related communications plans.
• BInterview key incident response stakeholders.
• CVerify industry best practices are incorporated into processes.
• DReview findings from recent security incidents.

• A
  14% (3)
• B
  76% (16)
• C
  5% (1)
• D
  5% (1)

Explanation

Interviewing key incident response stakeholders (B) is the correct first step because a newly appointed security manager must understand the current state before evaluating anything - and the people involved in the process are the primary source of truth about how it actually works in practice, not just on paper.

Why the distractors fall short:

• A (Test communications plans) - Testing comes after you understand what exists; jumping straight to testing skips the discovery phase.
• C (Verify best practices) - Benchmarking against industry standards is a later analytical step, not an initial fact-finding one; you need internal context first.
• D (Review recent incident findings) - Reviewing past findings is valuable, but documents alone don't capture the full picture - stakeholders provide context, gaps, and nuance that reports miss.

Memory tip: Think of the sequence as "Ask, Then Assess." A new manager's first job is always to listen and learn from the people on the ground before testing, benchmarking, or analyzing artifacts. In CISM/CISSP-style questions, when you see "FIRST" and "newly appointed," the answer almost always involves gathering human context over taking action.

No community discussion yet for this question.