Certified Information Security Manager (CISM)Incident ManagementHard
A CISO is tasked with implementing a new incident response playbooks system. The goal is to ensure that playbooks are actionable, consistent, and easily updated, allowing the incident response team (IRT) to respond effectively to a wide range of incidents. Which of the following approaches is MOST effective for designing and maintaining these playbooks?
- ACreating modular playbooks based on incident types, with adaptable response steps and decision points.
- BDeveloping highly detailed, prescriptive playbooks for every known threat scenario.
- CEntrusting senior IR analysts to maintain playbooks independently based on their experience.
- DUtilizing a commercial incident response platform that provides pre-built, static playbooks.
Show answer & explanationAnswer & explanation
Correct answer: A. Creating modular playbooks based on incident types, with adaptable response steps and decision points.
Creating modular playbooks based on incident types, with adaptable response steps and decision points, provides the optimal balance. It standardizes common actions while allowing flexibility for unique incident characteristics, making them actionable, consistent, and easier to update than highly prescriptive documents.
Why the other options are wrong
- B. Highly detailed, prescriptive playbooks are difficult to maintain, quickly become outdated, and lack adaptability for evolving threats.
- C. Independent maintenance by senior analysts can lead to inconsistencies, lack of standardization, and difficulty in knowledge transfer.
- D. Pre-built, static playbooks from a commercial platform may not perfectly align with an organization's specific environment and can be hard to customize or update.
Modular Incident Response Playbooks
Incident response documentation structured into reusable components or modules that can be combined and adapted for various incident types and scenarios.
- Promotes consistency while allowing flexibility.
- Easier to update and maintain than monolithic playbooks.
- Supports automation and orchestration efforts.
Memory trick: Playbooks should be like LEGOs, buildable and adaptable.