IR Lifecycle · BCP/DRP · Forensics · Communication · Post-Incident Review
30% of CISM Exam (150 Questions)
Study with Practice Tests →The largest CISM domain at 30%, Incident Management covers how organizations prepare for, detect, respond to, and recover from security incidents. It spans the full lifecycle from pre-incident planning through post-incident improvement.
45 of 150 questions come from this domain. Mastering incident response lifecycle steps, BCP vs. DRP distinctions, containment strategies, and communication protocols is essential.
CISM tests the manager's role, not the technical analyst's. Focus on: establishing IR capability, escalation criteria, communication chains, and continuous improvement — not forensic tool commands.
CISM questions often contrast containment (stop the bleeding) vs. eradication (remove root cause) vs. recovery (restore operations). Know which phase each activity belongs to.
Complete business disruption. Immediate executive notification. All-hands response. Examples: ransomware, data breach of PII.
Significant business impact. Senior management notified. Urgent response within hours. Examples: DDoS, major system compromise.
Moderate impact, limited spread. Team lead notified. Response within business day. Examples: malware on single workstation.
Minimal impact. Standard ticketing process. Response within SLA window. Examples: failed login attempts, spam.
| Term | Definition | CISM Distinction |
|---|---|---|
| Event | Any observable occurrence in a system or network | Not all events are incidents |
| Security Event | Event with potential security significance | Requires triage to determine severity |
| Incident | Event that violates security policy or threatens CIA triad | Requires formal IR response |
| Breach | Confirmed unauthorized access to or disclosure of protected data | Triggers legal/regulatory notification |
| Crisis | Incident with significant business, reputational, or safety impact | Escalates to BCP/crisis management |
| Disaster | Event causing prolonged inability to operate normally | Triggers DRP / BCM activation |
Coordinates the IR effort, makes containment decisions, communicates with management. Reports to CISO.
Technical investigation, log analysis, malware analysis, evidence collection. Provides data to IR Manager.
Advises on regulatory notification obligations, evidence preservation for litigation, attorney-client privilege considerations.
Manages external messaging to customers, media, regulators. Ensures consistent, approved messaging.
Execute technical remediation steps, apply patches, restore systems from backups under IR Manager direction.
Approves major decisions (pay ransom, shut down operations), receives regular briefings, accountable for outcomes.
CISM follows NIST SP 800-61 as the primary IR framework. Know the 4-phase model and the activities within each phase — especially what belongs in each step and in what order.
| Factor | Immediate Isolation | Monitor & Gather Intel |
|---|---|---|
| Risk of data exfiltration | High — isolate immediately | Low — can afford to watch |
| Safety / operational impact | Critical systems — isolate | Non-critical — monitor |
| Threat intelligence value | Already identified attacker | Unknown adversary — learn TTPs |
| Legal / law enforcement | No ongoing investigation | Law enforcement requests monitoring |
| Business continuity | System can be taken offline | Critical service — cannot disrupt |
| Document | Audience | Purpose | Detail Level |
|---|---|---|---|
| IR Plan | Management | Strategic: who does what, policy authority | High-level |
| IR Procedure | IR Team | Tactical: step-by-step IR process | Detailed |
| IR Playbook | Analysts | Scenario-specific: ransomware, phishing, DDoS runbooks | Prescriptive |
BCP and DRP are related but distinct disciplines. BCP focuses on keeping business operations running during a disruption; DRP focuses on recovering IT systems after a disaster. Both are essential CISM exam topics.
| Site Type | Readiness | Recovery Time | Cost | Best For |
|---|---|---|---|---|
| Hot Site | Fully operational, real-time data sync | Minutes to hours | Highest | Mission-critical systems |
| Warm Site | Hardware ready, data loaded periodically | Hours to days | Moderate | Business-critical systems |
| Cold Site | Space and power only, no equipment | Days to weeks | Lowest | Non-critical systems |
| Mobile Site | Portable units (trailers), rapidly deployable | Hours | Moderate | Geographic disasters |
| Cloud / Virtual | On-demand provisioning | Minutes (if pre-configured) | Pay-per-use | Modern cloud-native workloads |
| Reciprocal Agreement | Agreement with partner org to share space | Variable | Low (but unreliable) | Small organizations |
The absolute maximum time a business function can be unavailable before causing irreparable harm. Set by business leadership. This is the hard ceiling — RTO must be less than MTD.
Target time to restore a system or process after a disruption. RTO < MTD always. Set based on business requirements, then IT designs to meet it.
Maximum acceptable data loss measured in time. Determines backup frequency. If RPO = 4 hours, backups must run at least every 4 hours.
Time needed to restore and verify systems after recovery. RTO + WRT < MTD. Often overlooked — systems must be validated, not just online.
Example: MTD = 8 hrs. RTO = 4 hrs. WRT = 2 hrs. RTO + WRT = 6 hrs < 8 hrs ✅. If RTO + WRT ≥ MTD, the recovery strategy is insufficient.
| Type | What It Backs Up | Backup Time | Restore Time | Storage |
|---|---|---|---|---|
| Full | Everything, every time | Slowest | Fastest (single set) | Highest |
| Incremental | Changes since last backup (any type) | Fastest | Slowest (chain of sets) | Lowest |
| Differential | Changes since last full backup | Moderate | Faster than incremental (2 sets) | Moderate |
| Test Type | Method | Disruption Risk | Realism |
|---|---|---|---|
| Tabletop Exercise | Discussion-based walkthrough of scenario | None | Low |
| Walkthrough / Checklist | Team reviews plan step-by-step | None | Low |
| Simulation | Simulated scenario, partial activation | Low | Medium |
| Parallel Test | Recovery systems activated alongside production | Low | High |
| Full Interruption Test | Production shut down, full failover executed | High | Highest |
💡 CISM tip: Tabletop exercises are the most common and lowest-risk starting point. Full interruption tests are rarely performed due to business risk.
CISM-level forensics focuses on managerial responsibilities: ensuring evidence is preserved, chain of custody is maintained, and investigations are legally defensible — not performing the forensic analysis itself.
Collect evidence from most to least volatile: RAM → Swap → Network → Processes → Disk → Remote Logs → Archives. Volatile evidence is lost when system is powered off.
Documented record of who handled evidence, when, where, and how. Must be unbroken for evidence to be legally admissible. Every transfer of evidence must be logged and signed.
Use write blockers when acquiring disk images. Hash evidence (SHA-256) before and after to prove no modification occurred. Work on forensic copies — never originals.
When litigation is anticipated, a legal hold (litigation hold) suspends normal document retention/destruction policies. Failure to preserve can result in spoliation sanctions.
| Evidence Type | Definition | Forensic Examples |
|---|---|---|
| Direct | Directly proves a fact without inference | Video of attacker, access logs showing unauthorized commands |
| Circumstantial | Implies a fact through inference | Malware found on system, unusual login time pattern |
| Corroborating | Supports other evidence | Multiple log sources showing same event |
| Hearsay | Secondhand account — generally not admissible | Verbal report of what someone witnessed |
| Best Evidence | Original document preferred over copies | Original device preferred over forensic copy (but verified copies accepted) |
Regular status updates to CISO and C-suite. Translate technical details into business impact and financial language. Focus on: scope, business risk, actions taken, timeline to resolution.
Coordinate with Legal before any external disclosure. Know notification timeframes: GDPR 72hr, HIPAA 60-day, PCI-DSS 24hr to card brands. All communications go through Legal review.
Designate a single spokesperson. Use pre-approved communication templates. Never speculate about cause or scope. Acknowledge the situation, describe actions taken, avoid technical jargon.
Notify affected individuals promptly per legal requirements. Provide clear guidance on protective actions (password resets, credit monitoring). Be transparent about what happened and what data was affected.
Limit incident details to those who need them operationally. Premature disclosure can tip off attackers, compromise investigation, or create legal liability. Use code names for major incidents.
Pre-approved message templates, designated spokesperson, approved contact list, secure out-of-band communication channels, media holding statements, regulatory notification drafts.
| Activity | Timing | Purpose | Output |
|---|---|---|---|
| Lessons Learned Meeting | Within 2 weeks of closure | Capture what worked, what didn't | Action items list |
| Root Cause Analysis (RCA) | During/after incident | Identify true root cause, not symptoms | RCA report, corrective actions |
| After-Action Report | Within 30 days | Document full incident narrative for management | Formal incident report |
| IR Plan Update | After lessons learned | Improve plan based on real-world experience | Updated IR plan/playbooks |
| Metrics Review | Monthly/quarterly | Track IR KPIs (MTTD, MTTR, recurrence rate) | IR performance dashboard |
Average time from incident occurrence to detection. Lower = better detection capability. Improved by better monitoring and threat intelligence.
Average time from detection to full recovery. Improved by better playbooks, automation, and practice. Key IR performance metric.
% of incident types that occur more than once. High recurrence = root causes not being addressed. Target: declining trend.
Time from detection to effective containment. Shorter containment time = less damage and data loss. Measured per severity level.
10 CISM-style questions on Incident Management. Select the best answer and get instant feedback.
Mnemonics and visual anchors to make Domain 4 concepts stick for exam day.
Click a card to flip it and reveal the answer.
Select a category for targeted exam guidance.
Practice with 500+ CISM-style questions across all 4 domains on FlashGenius.
Unlock Full Practice Tests on FlashGenius →