Certified Information Security Manager (CISM)Incident ManagementHard
A multinational corporation uses a federated incident response model, where local business units handle initial incident triage and response, escalating to a central team only for major incidents. A CISO is reviewing this model. What is the MOST significant challenge this model may introduce compared to a fully centralized model?
- AIncreased cost due to redundant local staffing.
- BReduced adaptability to unique local compliance requirements.
- CDifficulty in maintaining consistent response procedures and standards across units.
- DSlower initial response times at the local level.
Show answer & explanationAnswer & explanation
Correct answer: C. Difficulty in maintaining consistent response procedures and standards across units.
In a federated model, while local teams can respond quickly to local issues, the primary challenge is ensuring that all local units adhere to the same overarching policies, procedures, and standards. This can lead to inconsistencies in incident handling, reporting, and evidence collection, potentially compromising the overall organizational security posture and legal defensibility.
Why the other options are wrong
- A. While there might be some redundancy, the benefit of local expertise often outweighs this. A federated model might even be more cost-effective for localized incidents by avoiding central team overhead for minor issues.
- B. A federated model typically allows for greater adaptability to unique local compliance requirements by empowering local teams with specific knowledge, making this a strength, not a challenge.
- D. A key advantage of a federated model is generally faster initial response times at the local level because decisions can be made closer to the incident.
Federated Incident Response
An incident response model where local or business unit teams handle initial incidents, escalating to a central team for complex or critical events.
- Leverages local expertise and faster initial response.
- Challenges include maintaining consistency and central oversight.
- Requires strong governance and communication frameworks.
Memory trick: Federated is flexible but fragmented.