Certified Information Security Manager (CISM)Incident ManagementMedium
A critical system outage at a large e-commerce company is identified as a major incident. The incident response team is struggling to contain the issue due to a lack of clear authority and decision-making processes. Which of the following is the MOST crucial element missing from their incident response plan that would address this challenge?
- AAn established incident command structure (ICS).
- BComprehensive post-incident review procedures.
- CDetailed technical containment playbooks.
- DA well-defined incident communication matrix.
Show answer & explanationAnswer & explanation
Correct answer: A. An established incident command structure (ICS).
The challenge described is a 'lack of clear authority and decision-making processes' during a major incident. An Incident Command Structure (ICS) is specifically designed to provide a standardized, hierarchical management system for all types of incidents, ensuring clear roles, responsibilities, and a defined chain of command for effective decision-making and coordination.
Why the other options are wrong
- B. Post-incident review happens after the incident is resolved and focuses on improvement, not on real-time decision-making during an active incident.
- C. Technical playbooks define *how* to contain, not *who* has authority to make decisions during containment.
- D. A communication matrix defines *who* gets informed *when*, but not *who* makes operational decisions during the incident.
Incident Command Structure (ICS)
A standardized, on-scene, all-hazards incident management concept that provides a flexible organizational structure for incident response.
- Ensures clear chain of command and responsibilities.
- Facilitates effective resource management and coordination.
- Scalable for incidents of varying size and complexity.
Memory trick: ICS: The 'Commander' in Chief for incidents.