CISM Question 62

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  When developing an escalation process within an incident response plan, the primary consideration is the affected stakeholders, as they define who needs to be informed, when, and at what level of escalation. Escalation paths are built around the impact to the business and stakeholders (e.g., executives, customers, regulators), ensuring that incidents receive the appropriate level of attention based on business risk.

• Chose B1

  CISM Framework Approach An organization establishes an incident response escalation matrix: ✔ Level 1: Incident detected → Assigned to Tier 1 analysts. ✔ Level 2: Escalated to Incident Response Team (IRT) for in-depth investigation. ✔ Level 3: Escalated to senior security leadership for major security breaches. By defining clear escalation paths, the IRT ensures a rapid, structured, and effective response, aligning with CISM risk and incident management best practices. Stakeholders are important but not the primary factor in designing an escalation process. Stakeholder communication happens after the IRT manages the incident. The primary factor when developing an escalation process is ensuring that the incident response team (IRT) can effectively respond to the incident.

• Chose A3

  Incident Response team is often form with representative from various department such as IT, vendors, legal and etc. Stakeholders include larger group of representatives that not part of the IRT. During incident response escalation, IT/SECURITY MANAGER 1st escalation always to the affected stakeholders. Business need to be aware of what is going on and be inform that the incident response team will be looking into the incident and report to the manager on the status update. To certain point of escalation, incident response team might report the status to the stakeholder directly.