Certified Information Security Manager (CISM)Incident ManagementEasy
A CISO is establishing an incident response team for a medium-sized enterprise. Which of the following roles is MOST critical to ensure effective coordination and decision-making during a major security incident?
- APublic Relations Specialist
- BForensic Analyst
- CLegal Counsel
- DIncident Commander
Show answer & explanationAnswer & explanation
Correct answer: D. Incident Commander
The Incident Commander is responsible for overall management of the incident, including strategy, objectives, and resource allocation, making it the most critical role for effective coordination and decision-making.
Why the other options are wrong
- A. A public relations specialist handles external communications but does not manage the internal incident response.
- B. A forensic analyst is crucial for technical investigation but doesn't lead the overall incident response.
- C. Legal counsel provides guidance on legal implications but is not directly responsible for incident coordination.
Incident Commander
The individual responsible for the overall management of a security incident, including strategic direction, operational planning, and resource allocation.
- Single point of authority during an incident.
- Ensures effective communication and coordination.
- Focuses on achieving incident response objectives.
Memory trick: The Commander's Shield protects the incident.