Certified Information Security Manager (CISM)Incident ManagementEasy
A CISO is evaluating the current incident response capabilities and discovers that while the technical team is proficient, there is a significant delay in communicating incident status and impact to executive management and external stakeholders. This delay often leads to misunderstandings and reputational damage. Which of the following should the CISO prioritize to resolve this issue?
- AConducting advanced forensic training for the incident response team.
- BDeveloping and regularly testing an incident communication plan.
- CImplementing a Security Orchestration, Automation, and Response (SOAR) platform.
- DHiring additional technical incident responders to speed up resolution.
Show answer & explanationAnswer & explanation
Correct answer: B. Developing and regularly testing an incident communication plan.
The core problem is 'significant delay in communicating incident status and impact'. Developing and testing an incident communication plan directly addresses this by formalizing roles, procedures, and templates for timely and accurate communication to all relevant stakeholders.
Why the other options are wrong
- A. Advanced forensic training improves technical analysis capabilities, which is not the root cause of communication delays to management and external parties.
- C. A SOAR platform automates technical response actions, but it doesn't inherently solve delays in human communication to executive management or external stakeholders.
- D. Hiring more technical responders might speed up technical resolution, but it doesn't solve the communication gap about that resolution to non-technical audiences.
Incident Communication Plan
A documented strategy outlining how an organization will communicate during and after a security incident, specifying stakeholders, messaging, channels, and timelines.
- Ensures timely and accurate information dissemination.
- Manages expectations and mitigates reputational damage.
- Tailored for different internal and external audiences.
Memory trick: To fix the talk lag, make a communication plan, no sag.