Certified Information Security Manager (CISM) Information Security Incident Management Syllabus

What is the value of retainer agreements with external incident response providers?

They guarantee rapid access to specialized forensic and response expertise and surge capacity during major incidents, with pre-negotiated terms reducing delay when an incident occurs.

What is the purpose of detection and monitoring capabilities in incident management?

To identify potential security incidents as early as possible through continuous observation of systems, networks, and logs, enabling timely response and reducing impact.

What does a SIEM (Security Information and Event Management) system do?

It aggregates, correlates, and analyzes log and event data from multiple sources in near real time to detect anomalies, generate alerts, and support investigation and reporting.

What is the difference between an IDS and an IPS?

An Intrusion Detection System (IDS) detects and alerts on suspicious activity but does not block it; an Intrusion Prevention System (IPS) detects and actively blocks or prevents the malicious traffic inline.

What is the difference between signature-based and anomaly-based (behavioral) detection?

Signature-based detection matches activity against known patterns of malicious behavior (effective for known threats); anomaly-based detection flags deviations from a baseline of normal behavior (can catch novel/zero-day threats but more false positives).

What are Indicators of Compromise (IoCs)?

Forensic artifacts or evidence (e.g., malicious IPs/domains, file hashes, registry changes, unusual traffic) that indicate a system may have been breached or is compromised.

What is triage in incident response?

The initial assessment and prioritization of reported events to validate whether they are genuine incidents, determine their category and severity, and assign appropriate response resources.

What is the main goal of the incident analysis/investigation phase?

To determine the scope, root cause, attack vector, affected assets, and impact of the incident so containment, eradication, and recovery can be performed effectively.

Why is establishing a baseline of normal activity important for detection and triage?

It enables analysts to distinguish anomalous, potentially malicious behavior from legitimate operations, reducing false positives and improving accuracy of incident identification.

What are the three steps in the containment, eradication, and recovery phase?

Containment (limit the spread/damage), eradication (remove the threat and its artifacts), and recovery (restore systems to normal operation and confirm they are clean).

What is the difference between short-term and long-term containment?

Short-term containment quickly limits damage (e.g., isolating a host) without a permanent fix; long-term containment applies more durable measures (e.g., temporary fixes/rebuilds) to keep systems operational until full eradication and recovery.

What does eradication involve in incident response?

Removing the cause and components of the incident, such as deleting malware, disabling compromised accounts, closing exploited vulnerabilities, and eliminating attacker footholds/backdoors.

What activities occur during the recovery phase?

Restoring affected systems and data from clean backups, rebuilding/hardening systems, validating they function correctly and are no longer compromised, and monitoring closely before returning to normal operations.

Why might immediate containment by powering off a system be undesirable?

It can destroy volatile evidence (memory, running processes, network connections) needed for forensic investigation and may alert the attacker; isolation may be preferable to preserve evidence.

What is the purpose of digital forensics in incident management?

To collect, preserve, analyze, and present digital evidence in a manner that maintains its integrity and admissibility, to determine what happened and support legal or disciplinary action.

What is the chain of custody and why is it critical?

A documented record of who collected, handled, transferred, and stored evidence, with times and purposes; it is critical to prove evidence integrity and ensure admissibility in legal proceedings.

What is the order of volatility in evidence collection?

The principle of collecting the most volatile (transient) evidence first—e.g., CPU registers/cache, RAM, network state, running processes—before less volatile data like disk, logs, and archived media.

Why are forensic images (bit-for-bit copies) and hashing used in evidence handling?

Analysis is performed on an exact bit-level copy to protect the original, and cryptographic hashes (e.g., SHA-256) verify the image is identical and unaltered, proving evidence integrity.

What is the difference between forensic evidence integrity and admissibility?

Integrity means the evidence has not been altered (proven via hashing and chain of custody); admissibility means it can be legally accepted in court, requiring proper, lawful collection and handling per evidence rules.

What is a Business Impact Analysis (BIA)?

A process that identifies critical business processes and assets, and determines the operational, financial, and reputational impact of their disruption over time to prioritize recovery and resilience efforts.

What is Recovery Time Objective (RTO)?

The maximum acceptable amount of time a business process or system can be unavailable after a disruption before unacceptable consequences occur—i.e., the target time to restore it.

What is Recovery Point Objective (RPO)?

The maximum acceptable amount of data loss measured in time—i.e., the point in time to which data must be recovered, defining how frequently backups must be taken.

What is the difference between RTO and RPO?

RTO measures acceptable downtime (how fast you must restore a system); RPO measures acceptable data loss (how much data, in time, you can afford to lose before recovery).

What is Maximum Tolerable Downtime (MTD)?

The total maximum time a critical process can be unavailable before the organization suffers irreversible damage; MTD = RTO + Work Recovery Time (WRT).

How do RTO and RPO relate to MTD?

MTD is the overall limit on disruption; RTO (time to restore systems) plus WRT (time to validate and resume operations) must be less than or equal to the MTD.

What is the difference between a BCP and a DRP?

A Business Continuity Plan (BCP) keeps essential business functions running during/after a disruption (broad, business-focused); a Disaster Recovery Plan (DRP) focuses on restoring IT systems, data, and infrastructure (technical subset).

Compare hot, warm, and cold recovery sites.

A hot site is fully equipped and operational for near-immediate failover; a warm site has hardware/connectivity but needs data and configuration (hours to days); a cold site provides only space and utilities, requiring full setup (longest recovery, lowest cost).

Why must incident response, BCP, DRP, and crisis management plans be integrated?

Because a major incident can escalate into a continuity event; integrated, consistent plans ensure smooth escalation, coordinated roles, shared communication, and a unified response without gaps or conflicts.

Why must incident response plans be regularly reviewed and maintained?

To keep them current with changes in technology, business processes, threats, personnel, and regulations, and to incorporate lessons learned so the plan remains effective and accurate.

What triggers an update to the incident response plan outside scheduled reviews?

Significant changes such as new systems/architecture, organizational restructuring, mergers, new regulatory requirements, emerging threats, or findings from incidents and exercises (lessons learned).

What is the primary purpose of incident communication and notification procedures?

To ensure timely, accurate, and appropriate information flows to the right internal and external stakeholders during an incident, supporting coordinated response, legal compliance, and reputation management.

Why are predefined communication channels and contact lists important during incident response?

Because normal channels (e.g., email) may be compromised or unavailable; out-of-band, predefined channels and up-to-date contact lists ensure reliable, secure, and rapid communication during a crisis.

What external parties may need to be notified during a security incident?

Regulators/supervisory authorities, affected customers/data subjects, law enforcement, business partners, cyber-insurance providers, and potentially the public/media—depending on legal and contractual obligations.

Why are breach notification regulatory timelines (e.g., GDPR's 72 hours) important to incident management?

Many laws mandate notifying authorities and affected individuals within strict deadlines; the incident plan must build in detection, assessment, and notification processes to meet these timelines and avoid penalties.

What is the purpose of a post-incident review (lessons-learned/post-mortem)?

To analyze how the incident was handled, identify root causes and response gaps, and produce actionable improvements to controls, processes, and the response plan to prevent recurrence.

What questions should a post-incident review answer?

What happened and when, how well did staff and the plan perform, what information was needed sooner, what would be done differently, what corrective actions are needed, and how to prevent recurrence.

What are common metrics/KPIs used to evaluate incident response effectiveness?

Mean Time to Detect (MTTD), Mean Time to Respond/Contain (MTTR/MTTC), number and type of incidents, dwell time, cost/impact per incident, and percentage of incidents resolved within SLA.

Why should the root cause—not just the symptoms—be addressed after an incident?

Treating only symptoms leaves the underlying vulnerability or weakness in place, allowing recurrence; root-cause remediation strengthens controls and prevents repeat incidents.

Why are incident response plans tested and exercised regularly?

To validate the plan's effectiveness, train staff on their roles, identify gaps and weaknesses before a real incident, and confirm tools, communications, and procedures work as intended.

Compare a tabletop exercise with a full-scale (functional/simulation) test.

A tabletop is a discussion-based walkthrough where the team talks through their response to a scenario (low cost, low disruption); a full-scale test actually executes the response with real systems and resources (more realistic, more costly and disruptive).

What is the difference between a checklist/walkthrough review and a parallel/full-interruption continuity test?

A checklist/walkthrough reviews plan completeness on paper; a parallel test brings up recovery systems alongside production without stopping it; a full-interruption test actually shifts operations to recovery systems, providing the most realistic but highest-risk validation.