Certified Information Security Manager (CISM)Incident ManagementMedium
A CISO is developing an incident response capability for a rapidly growing startup with limited resources. The goal is to establish a functional and efficient incident response process quickly. Which of the following principles should the CISO prioritize to achieve this objective?
- AFocusing on a lean approach with well-defined, essential processes and roles.
- BBuilding a comprehensive forensic lab for in-depth malware analysis.
- COutsourcing all incident detection and response to a managed security service provider (MSSP).
- DImplementing a fully automated security orchestration, automation, and response (SOAR) platform.
Show answer & explanationAnswer & explanation
Correct answer: A. Focusing on a lean approach with well-defined, essential processes and roles.
For a rapidly growing startup with limited resources, a lean approach focusing on well-defined, essential processes and roles is the most pragmatic and efficient way to establish a functional incident response capability quickly. This ensures that core response functions are covered without overspending or overcomplicating initial efforts.
Why the other options are wrong
- B. A comprehensive forensic lab is an advanced and expensive capability, not essential for quickly establishing a functional initial incident response for a startup.
- C. While outsourcing can be an option, building internal capability is often preferred for core business functions; outsourcing 'all' detection and response might be costly and reduce internal learning.
- D. A SOAR platform is a significant investment and complexity, likely beyond a startup's initial resources for a quick setup.
Lean Incident Response
An approach to incident response that focuses on establishing core capabilities with minimal resources, emphasizing efficiency, essential processes, and adaptability.
- Prioritizes effectiveness over extensive tools or teams.
- Ideal for startups or organizations with limited budgets.
- Emphasizes continuous improvement and scaling as resources grow.
Memory trick: Start lean, grow strong.