Certified Information Security Manager (CISM)Incident ManagementEasy
A global enterprise with diverse business units is developing its incident response strategy. The CISO wants to ensure that each business unit can manage localized incidents efficiently while maintaining overall corporate oversight and consistency. Which incident response model BEST supports this requirement?
- ACentralized Incident Response Model
- BOutsourced Incident Response Model
- CFederated Incident Response Model
- DHybrid Incident Response Model
Show answer & explanationAnswer & explanation
Correct answer: C. Federated Incident Response Model
A federated incident response model allows local business units to handle their own incidents, promoting efficiency and understanding of local context, while a central team provides governance, coordination, and support for major or cross-cutting incidents.
Why the other options are wrong
- A. A centralized model would centralize all incident handling, which would hinder local efficiency and responsiveness for diverse business units.
- B. An outsourced model delegates incident response to a third party, which may not provide the desired level of local control or corporate oversight.
- D. A hybrid model can refer to various combinations, but 'federated' specifically describes the distributed yet coordinated structure needed here.
Federated Incident Response Model
An incident response structure where local teams handle routine incidents within their domain, while a central team provides coordination, advanced support, and handles major or cross-organizational incidents.
- Balances local autonomy with central oversight.
- Efficient for distributed organizations.
- Ensures consistent standards across the enterprise.
Memory trick: Federated is like a federal government: states (BUs) handle local, feds (central) handle national.