CISM Question 155

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  That is clear other are important but with less priority. Missing information or not update il a clear issue and likelihood on response plan defeat is real. Industries best practice could be take in consideration but it's no meaning that are alligned with company requirement or constrain

• Chose D1

  The correct answer is D. ISACA’s CISM material explicitly says the incident response plan should be tested, reviewed and revised periodically to ensure that it remains effective. The current CISM Exam Content Outline likewise states that incident management plans are evaluated through testing and review “at planned intervals.” The answer cannot be B. This is the distractor that can feel very compelling. If missing information interferes with recovery, you absolutely have a problem to address. However, waiting until a deficiency actually affects recovery is reactive. CISM emphasizes maintaining and testing the plan proactively. To put things into perspective, if you review your IRP annual, biannually, or quarterly you will catch the gaps in the plan that misalign with business objectives or content that is missing.

• Chose B2

  This directly signals that the plan itself has a functional gap.