Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
the severity of an incident is NOT ONLY defined by its duration
page 288: The escalation process include prioritizing event information and decision process for determining when to alert various groups...
definitely not B A security incident escalation policy defines the procedures for escalating security incidents based on their severity and potential impact. It outlines the specific criteria for determining when to involve various groups within the organization, such as senior management, legal counsel, and external experts. B. A severity-ranking mechanism tied only to the duration of the outage: Outage duration can be a factor in incident severity, but it's not the sole determinant. The policy should consider other factors such as the potential impact on data, systems, and reputation.