ISACA Certified Information Systems Auditor (CISA) ExamDomain 5: Protection of Information AssetsMedium
A CISA is auditing an organization's security incident management process. The organization has recently experienced several phishing attacks leading to credential compromise. Which of the following areas should the CISA prioritize for evaluation to improve the organization's response capability?
- AThe vendor contracts for security information and event management (SIEM) solutions.
- BThe annual budget allocated for security awareness training programs.
- CThe frequency of external security audits and penetration tests.
- DThe effectiveness of the incident response plan's communication protocols and escalation procedures.
Show answer & explanationAnswer & explanation
Correct answer: D. The effectiveness of the incident response plan's communication protocols and escalation procedures.
Given recent incidents, prioritizing the evaluation of communication protocols and escalation procedures within the incident response plan is crucial. Timely and effective communication and escalation ensure that incidents are handled efficiently, limiting damage and improving recovery, which is a direct measure of response capability.
Why the other options are wrong
- A. SIEM contracts relate to monitoring capabilities, which precede response, but don't directly address the response process itself.
- B. Security awareness training aims to prevent incidents, not primarily to improve the response process once an incident occurs.
- C. Audits and penetration tests focus on identifying vulnerabilities, not directly on response capability.
Incident Response Communication
The structured exchange of information during a security incident, including internal team coordination, stakeholder notification, and external reporting, guided by predefined protocols and escalation paths.
- Ensures timely information flow.
- Prevents miscommunication and delays.
- Critical for effective incident containment and resolution.
Memory trick: When an alarm rings, clear voices and a direct path are key.