Of the following, who is accountable for ensuring the incident response plan is tested?

The correct answer is D. Information security manager. The information security manager is accountable for ensuring the incident response plan is tested because they own the information security program, of which the IR plan is a key component. Accountability means being answerable for outcomes - the security manager ensures…

Submitted by cyberguy42· Apr 18, 2026Information Security Incident Management

Question

Options

ABusiness process owner
BBusiness continuity manager
CIncident response team members
DInformation security manager

How the community answered

(31 responses)

A
3% (1)
B
3% (1)
C
6% (2)
D
87% (27)

Explanation

The information security manager is accountable for ensuring the incident response plan is tested because they own the information security program, of which the IR plan is a key component. Accountability means being answerable for outcomes - the security manager ensures testing happens, even if others execute it. The business process owner (A) is accountable for business assets, not the IR program. The business continuity manager (B) manages BCPs, which are related but distinct. IR team members (C) participate in testing but are responsible for execution, not for ensuring testing occurs at the program governance level.

Topics

#Incident Response Plan Testing#Accountability#Information Security Manager#Roles and Responsibilities

Community Discussion

No community discussion yet for this question.

Full CISM Practice