Exam CISM topic 1 question 62 discussion

When developing an escalation process for an incident response plan, the information security manager should PRIMARILY consider the affected stakeholders. The escalation process should be designed to ensure that the appropriate stakeholders are notified at the appropriate time, in order to minimize the impact of the incident on the organization. Stakeholders could include executives, legal counsel, IT teams, customers, vendors, and regulatory bodies, depending on the nature of the incident.

CISM Framework Approach An organization establishes an incident response escalation matrix: ✔ Level 1: Incident detected → Assigned to Tier 1 analysts. ✔ Level 2: Escalated to Incident Response Team (IRT) for in-depth investigation. ✔ Level 3: Escalated to senior security leadership for major security breaches. By defining clear escalation paths, the IRT ensures a rapid, structured, and effective response, aligning with CISM risk and incident management best practices. Stakeholders are important but not the primary factor in designing an escalation process. Stakeholder communication happens after the IRT manages the incident. The primary factor when developing an escalation process is ensuring that the incident response team (IRT) can effectively respond to the incident.

Incident Response team is often form with representative from various department such as IT, vendors, legal and etc. Stakeholders include larger group of representatives that not part of the IRT. During incident response escalation, IT/SECURITY MANAGER 1st escalation always to the affected stakeholders. Business need to be aware of what is going on and be inform that the incident response team will be looking into the incident and report to the manager on the status update. To certain point of escalation, incident response team might report the status to the stakeholder directly.

Again, you are a manager and you are considering the bigger picture. "Affected stakeholders" is the most comprehensive answer here.

When developing an escalation process for an incident response plan, the primary consideration should be the incident response team. This involves defining how and when to escalate incidents within the team based on the severity, complexity, or other factors. The incident response team plays a crucial role in coordinating the organization's response to security incidents.

The primary consideration in developing an escalation process for an incident response plan is ensuring that the affected stakeholders are identified and included in the escalation procedures. This involves understanding who needs to be informed, involved, or notified at different stages of the incident response process based on the nature and severity of the incident. Stakeholders may include senior management, legal, communications, IT teams, and other relevant parties. While the incident response team (option B), availability of technical resources (option C), and media coverage (option D) are important factors, the focus in the escalation process is on addressing the needs and expectations of the stakeholders who are impacted or have a vested interest in the incident.

Ideally affected stakeholders should already include incident response team so answer A is more suitable here.

A. affected stakeholders. The primary focus should be on ensuring that the affected stakeholders are identified, informed, and involved in the incident response process. This includes internal and external stakeholders such as employees, customers, partners, regulatory authorities, and potentially the public, depending on the nature and severity of the incident. Ensuring effective communication and coordination with stakeholders is crucial during incident response to manage the situation effectively and minimize potential damage. While the incident response team, technical resources, and media coverage are also important considerations, they should be addressed in conjunction with the needs and concerns of the affected stakeholders.

A. IRT is a subset of affected stakeholders

Primarily should be the team

Why not availability of technical resources? Escalation must be done to the correct resources to be able to resolve or contain the incident?

Incident response team notifies the affected stakeholders

B. incident response team.

why not B?