CISM Question 308

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C3

  C. Identifying regulatory requirements All the options are important, identifying regulatory requirements takes precedence because it directly relates to legal obligations and potential legal consequences. Processing personal and financial information often involves compliance with a range of laws and regulations, such as GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Accountability Act), or various financial industry regulations (e.g., PCI DSS for payment card data). Failing to comply with these regulations can lead to severe penalties, fines, and reputational damage.

• 2

  C. Identifying regulatory requirements All the options are important, identifying regulatory requirements takes precedence because it directly relates to legal obligations and potential legal consequences. Processing personal and financial information often involves compliance with a range of laws and regulations, such as GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Accountability Act), or various financial industry regulations (e.g., PCI DSS for payment card data). Failing to comply with these regulations can lead to severe penalties, fines, and reputational damage. Once you understand the regulatory landscape and requirements that apply to your organization, you can then align with an established industry framework (option A), determine budgetary constraints (option B), and align with enterprise architecture (option D) to ensure that your incident response plans are comprehensive and effective. However, regulatory compliance should be the primary driver for incident response planning in this specific context.

• Chose C2

  C. Identifying regulatory requirements