Certified Information Security Manager (CISM)Incident ManagementEasy
A financial institution is developing its incident response plan. The CISO is reviewing the objectives and wants to ensure that the plan effectively addresses the organization's regulatory obligations and minimizes financial impact. Which of the following incident response objectives is MOST crucial for achieving these goals?
- ATo identify the root cause of the incident and implement preventative measures.
- BTo restore affected systems to full operational capacity as quickly as possible.
- CTo comply with legal and regulatory reporting requirements and preserve evidence.
- DTo contain the incident and eradicate the threat to prevent further damage.
Show answer & explanationAnswer & explanation
Correct answer: C. To comply with legal and regulatory reporting requirements and preserve evidence.
While all options are important incident response objectives, complying with legal and regulatory reporting requirements and preserving evidence directly addresses regulatory obligations and helps minimize financial impact by avoiding fines and facilitating potential legal action.
Why the other options are wrong
- A. Root cause analysis is crucial for long-term prevention but is a post-incident activity and doesn't directly address immediate regulatory or financial impact.
- B. Restoration is important for business continuity but doesn't directly address regulatory compliance or financial impact from non-compliance.
- D. Containment and eradication are immediate operational objectives to limit damage, but not the primary objective for regulatory compliance or financial impact minimization related to reporting.
Incident Response Objectives
Clear, measurable goals that guide an organization's actions during and after a security incident, ensuring a structured and effective response.
- Crucial for aligning incident response with business goals.
- Help prioritize actions during an incident.
- Vary based on organization's risk profile and regulatory environment.
Memory trick: An incident's objective is to 'C.R.E.A.T.E.' a safe environment: Contain, Recover, Eradicate, Analyze, Train, and Evidence.