Exam CISM topic 1 question 185 discussion

stop using chatgpt please !!! you can close each incident in seconds without managing the situation. The reduction of ALE with a reduction of the SLE is the correct answer. Stop using the AI please

C. reduction of the annual loss expectancy (ALE). The effectiveness of an organization's incident response capabilities is often measured by the reduction of the annual loss expectancy (ALE). ALE is a financial metric that helps assess the potential financial impact of security incidents. By reducing the ALE through effective incident response, an organization demonstrates that it is minimizing the financial losses associated with security incidents, which is a key indicator of effective incident response capabilities.

Going with C. In CISA QAE, the best indicator to determine the effectiveness of the incident response team is financial impact per security incident.

While ALE can indirectly reflect the effectiveness of incident response, it is not the primary metric used for that purpose. ALE is more commonly employed to prioritize security controls, determine the cost-effectiveness of security investments, or assess the overall risk landscape. Incident response effectiveness is better evaluated through specific performance indicators related to incident handling and recovery, such as mean time to detect (MTTD), mean time to respond (MTTR), and overall incident resolution rates. So, time to closure of incidents makes more sense.

D. time to closure of incidents.

This measures the speed and efficiency of the organization's incident response process, which is a critical aspect of managing security incidents and minimizing their impact on the business. A shorter time to closure indicates that incidents are being detected and resolved more quickly, which can help minimize the damage caused by security incidents.

Team, it is C. Quick response to incidents is great, but we need to actually see the results, and at the end of the day they are base in numbers! So, Annualized loss expectancy (ALE) This is the expected annualized loss of asset value due to threat realization. ALE is defined as SLE × ARO. Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (p. 232). McGraw Hill LLC. Kindle Edition.

ALE is risk management does not relate with incident. so best answer is D

D. time to closure of incidents is a measure of the effectiveness of the incident response capabilities of an organization. The time to closure of incidents is the amount of time it takes for an organization to detect, respond to, and resolve an incident. A shorter time to closure indicates that the organization has a more efficient incident response process in place. It means that the incident was identified quickly, the appropriate actions were taken promptly and effectively, and the incident was resolved as soon as possible, minimizing the impact on the organization. Therefore, measuring the time to closure of incidents allows an organization to evaluate its incident response process, identify areas for improvement and ensure that it is prepared to handle future incidents effectively.

incident response is needed to evaluate the time of close incident.