Certified Information Security Manager (CISM)Incident ManagementMedium
A global enterprise with diverse business units is developing its incident response strategy. The CISO is evaluating models to balance centralized control with local responsiveness. Which incident response model is BEST suited for an organization that requires a strong central oversight but also empowers local teams to handle routine incidents independently?
- AFederated model
- BDistributed model
- CCentralized model
- DOutsourced model
Show answer & explanationAnswer & explanation
Correct answer: A. Federated model
A federated incident response model balances centralized control with local autonomy. It allows local teams to handle routine incidents within their scope while providing central oversight, shared resources, and escalation paths for major or complex incidents, fitting the requirement for both central oversight and local responsiveness.
Why the other options are wrong
- B. A distributed model provides local autonomy but may lack consistent standards and central oversight.
- C. A centralized model lacks local responsiveness and can be overwhelmed by routine incidents.
- D. An outsourced model relies on a third party, which doesn't directly address balancing internal central control with internal local responsiveness.
Federated Incident Response Model
An incident response model that combines elements of centralized and distributed approaches, allowing local teams to handle incidents independently while a central team provides governance, shared services, and manages major incidents.
- Balances local autonomy with central oversight.
- Promotes consistency while enabling flexibility.
- Effective for large, geographically dispersed organizations.
Memory trick: Federated: United by a core, flexible in the field.