Exam CISM topic 1 question 165 discussion

The question is stating that the average time to prioritize an incident has increased. What is the problem with the process? Is it a personnel/staffing issue? Are they not able to classify it because that information is not clear? Is it a cultural problem due to outsourcing? I get A, but the question is vague. So does the whole incident response process need to be evaluated? B

Triage step happens before the Response step in an incident management plan. Categorization is the process using predetermined criteria to classify all incoming reports/events, then responding to them. So A would take place before B.

Option A

A - The best way to work on prioritization is to classifiy the type of incidents to work on.

I would agree with oluchecpoint that the correct answer here is B

B. Incident response The best process to enable the information security manager to address the concern of an increased mean time to prioritize information security incidents is the incident response process. Incident response involves a structured approach to managing and addressing security incidents as they occur. This process includes the following key steps:

A. Incident classification