Exam CISM topic 1 question 115 discussion

A. Escalation procedures An information security manager cannot take that decision at the moment without following the procedure.

A. Escalation procedures. Escalation procedures typically outline the steps and criteria for involving external parties, such as third-party support providers, in the incident response process. These procedures help determine when it's necessary to seek external expertise or assistance in mitigating and resolving a security incident. This could include scenarios where the incident exceeds the organization's in-house capabilities or expertise. Therefore, escalation procedures are the primary means for authorizing such transfers.

Keyword "defined" by, that is a procedure. If they stated "authorized" by, that could be one of the stakeholders like the ISM.

A. Escalation procedures. Escalation procedures typically outline the steps and criteria for involving external parties, such as third-party support providers, in the incident response process. These procedures help determine when it's necessary to seek external expertise or assistance in mitigating and resolving a security incident. This could include scenarios where the incident exceeds the organization's in-house capabilities or expertise. Therefore, escalation procedures are the primary means for authorizing such transfers.

C. chain of custody.

The correct answer is (A) escalation procedures cause the steps are defined here by ISM and other stakeholders. Rationale: (B.) the information security manager is incorrect. Because escalation procedures are usually done alongside stakeholders and not just by the infosec manager. This is because the infosec manager may or may not be present. The infosec manager may or may not represent the interest of the business correctly. Even if he could do it well without eh business, if the manager leaves another manager may have a different process entirely. So this leads to inconsistency. Instead, the infosec manager alongside stakeholders should document it in an escalation procedure, and his predecessor/successor review and improve it. So it is instead preferred to have it in a documented process which is (A). (C.) chain of custody is how you enforce it, but not authorize it. Authorization is by the infosec manager by what has been defined in the escalation procedures. (D.) disaster recovery plan (DRP) relates to incidents and not necessarily security incidents.

Escalation procedures describe the steps that should be taken to manage and resolve security incidents, including when and how to involve external parties such as third-party support providers. These procedures typically include criteria for escalating incidents, such as severity level or resource constraints, and define the roles and responsibilities of different stakeholders involved in the incident response process.

Information security manager (supported by the steering securiy committe). So its B

B. information Security Manager

The information security manager is responsible for overseeing the security of the organization's information systems and data. In the event of an internal security incident, the information security manager has the authority to make decisions about the response to the incident, including the transfer of the incident handling to a third-party support provider. The information security manager considers factors such as the nature and severity of the incident, the resources and capabilities of the organization's internal security team, and the expertise and resources available from the third-party support provider when making a decision about transferring incident handling. While escalation procedures, chain of custody, and disaster recovery plan (DRP) may also play a role in the response to a security incident, the primary decision-making authority rests with the information security manager. These other elements provide guidelines and procedures for responding to incidents, but the information security manager is responsible for making the final decision about how the incident will be handled.

Chain of custody forms that provide: name and contact information of custodians, when, why and by whom an evidence item was acquired or moved.