ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  An escalation procedure needs to be defined in order to not impact timeous response to incidents in active incidents. This should be documented as part of the incident management process. Failure to do so will lead to delays in responding to incidents as the people responsible for responding will not be notified on time.

• Chose D1

  Without a clear, predefined escalation process, even the best security tool or recovery plan will fail because nobody will know how to handle off and coordinate the emergency across company lines.

• Chose D1

  Build the escalation matrix first (contacts, severity criteria, out-of-band channels, joint tabletop exercises). Then align RTO commitments, review the latest audit reports, and select the technical tooling that supports those agreed processes. That order keeps the strategy executable when the incident actually occurs.