CISM Question 270

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 3

  I said B but further analysis would be C if you being petty. (B) Average recovery time per incident speaks more of incident response than control effectiveness. (C) directly relates to the malware code infection control.

• Chose B5

  B. Average recovery time per incident This metric measures how quickly the organization can recover from incidents caused by malicious code. A shorter average recovery time indicates that the countermeasures in place are effective at minimizing downtime and mitigating the impact of malicious code outbreaks. It directly assesses the organization's ability to respond to and recover from such incidents, which is a critical aspect of cybersecurity incident management.

• 1

  B. Average recovery time per incident makes more sense to me.