Exam CISM topic 1 question 402 discussion

in the response plan, it will be decided.

It should be D - A dedicated public relations spokesperson From CISM RM 16th, Public relations (PR) representative will provide controlled communication to internal and external stakeholders to minimize any adverse impact

A - During a serious security breach, the information being communicated is often highly sensitive and technical, so option A is the best option.

Ext entitties can be public, regulatory, law enforcement,... it's sefined in plan

response plan

We dont know the context of the situation, with the information given the best answer is to review the incident response plan to see who is responsible in communicating such an incident. You are going to want a SME to communicate with external parties, it's not always going to be the same person.

I think the answer is C, as for a serious cyber incident an organisation may want the CEO to communicate with the Media, Reg affairs will deal with regulatory authorities , so whatever is in the incident plan based on the level of incident.

cism aio 2nd: risis communications often establishes relationships with internal and external parties such as investor relations, public safety, and news media. Policy related to crisis manage- ment and crisis communications should define the personnel authorized to communi- cate with external parties. But even then, an organization’s top executives may often be required to approve individual external communications.

It’s important that there is a chapter in the incident response plan dedicated to communication. I don’t agree with “D” because is not even requested a “public” communication, just for example for incidents that the management want to communicate just to some stakeholders or external entities

if external entities are third parties it's C

D. A dedicated public relations spokesperson

senior management have the ultimate responsibility. Whoever they decide to communicate will override all the others

I would choose C. A and D should be defined in the incident response plan

A. So for all of those below, your telling me you would ignore senior management on identifying who the person/people should be to speak to external entities? I'm going with what senior management says.

C is correct

I also go with D.

Agreed