While responding to a security incident, the response team realizes the cost of the resolution might exceed the value of the asset. Which of the following should be the response team's FIRST course…

The correct answer is B. Escalate to management. When the cost of resolution may exceed the value of the asset, the response team should first escalate the issue to management, who are responsible for making risk-based decisions and determining the appropriate course of action.

Submitted by zhang_li· Apr 18, 2026Information Security Incident Management

Question

While responding to a security incident, the response team realizes the cost of the resolution might exceed the value of the asset. Which of the following should be the response team’s FIRST course of action?

Options

APerform a cost-benefit analysis.
BEscalate to management.
CPerform a risk assessment.
DVerify damage to the business.

How the community answered

(41 responses)

A
10% (4)
B
80% (33)
C
7% (3)
D
2% (1)

Explanation

When the cost of resolution may exceed the value of the asset, the response team should first escalate the issue to management, who are responsible for making risk-based decisions and determining the appropriate course of action.

Topics

#Incident Escalation#Incident Response Process#Management Reporting#Resource Allocation

Community Discussion

No community discussion yet for this question.

Full CISM Practice