Examius
🇬🇧 CISMP (Certificate in Information Security Management Principles) · subject
CISMP (Certificate in Information Security Management Principles) Business Continuity, Incident Management and Assurance Syllabus
The Business Continuity, Incident Management and Assurance syllabus for CISMP (Certificate in Information Security Management Principles) in full: 3 chapters, 12 topics and 18 sub-topics, every one listed below, plus 61 Business Continuity, Incident Management and Assurance flashcards with answers.
Business Continuity, Incident Management and Assurance syllabus: all 3 chapters
Expand any chapter to see its topics and sub-topics.
-
Incident Management
4 topics- Incident management lifecycle
- Detection, reporting and triage
- Containment, eradication and recovery
- Roles and escalation
- Incident response team
- Communications and notification
- Learning from incidents
- Post-incident review
- Feedback into controls
- Digital forensics and evidence
- Preserving the chain of custody
- Incident management lifecycle
-
Business Continuity and Disaster Recovery
4 topics- Business continuity management
- Business impact analysis
- RTO and RPO
- Disaster recovery planning
- Recovery strategies and sites
- Invocation and escalation
- Testing and maintenance
- Exercising the plan
- Keeping plans current
- Relationship to information security
- Availability and resilience
- Business continuity management
-
Investigations, Assurance and Continual Improvement
4 topics- Security assurance methods
- Audit, review and assessment
- Investigations and disciplinary action
- Conducting internal investigations
- Metrics and reporting
- Key performance and risk indicators
- Continual improvement
- Corrective and preventive action
- Security assurance methods
CISMP (Certificate in Information Security Management Principles) Business Continuity, Incident Management and Assurance flashcards — 61 questions with answers
What are the recognised phases of the incident management lifecycle (as typically taught in CISMP / aligned to ISO/IEC 27035)?
Plan and prepare; Detection and reporting; Assessment and decision (triage); Response (containment, eradication, recovery); Lessons learned (post-incident review).
In information security, what is the definition of a 'security event' versus a 'security incident'?
A security event is any observable occurrence in a system or network. A security incident is one or more related, identified security events that compromise (or threaten) confidentiality, integrity or availability and warrant a response.
What is the primary objective of incident management?
To restore normal service operation as quickly as possible while minimising adverse impact on the business, and to ensure the best possible levels of service quality and availability are maintained.
What is 'triage' in the context of incident handling?
The initial assessment and prioritisation of a reported incident — categorising it, judging its severity/impact, and deciding the response and who should handle it.
Define 'containment' as a step in incident response.
Actions taken to limit the scope and magnitude of an incident — stopping it spreading and preventing further damage — before eradication and recovery.
What is the difference between 'eradication' and 'recovery' in incident response?
Eradication removes the cause of the incident (e.g. malware, compromised accounts, vulnerabilities). Recovery restores affected systems and services to normal, validated operation.
What is a CSIRT (also called CERT)?
A Computer Security Incident Response Team — a designated group responsible for receiving, reviewing and responding to computer security incident reports and activity.
What is the purpose of an incident response 'playbook' or runbook?
A predefined, step-by-step set of procedures for responding to a specific type of incident, ensuring a consistent, repeatable and timely response.
Why is escalation important in incident management, and what triggers it?
Escalation ensures incidents reach staff with the right authority/skill. Triggers include rising severity/impact, breach of SLA timeframes, inability to resolve at the current level, or legal/regulatory implications.
Distinguish 'functional escalation' from 'hierarchical escalation'.
Functional (horizontal) escalation passes an incident to a team with the needed technical expertise. Hierarchical (vertical) escalation raises it to higher management for awareness, authority or resources.
What is the role of the Incident Manager (incident coordinator)?
To own and coordinate the end-to-end response: directing the team, controlling communications, making/escalating decisions, and ensuring the incident is documented and resolved.
Why should senior management be involved in significant security incidents?
They hold accountability and authority to commit resources, make business-risk decisions, authorise external communication, and meet legal/regulatory reporting obligations.
What is the purpose of the 'lessons learned' / post-incident review phase?
To analyse how the incident was handled, identify root causes and weaknesses, and feed improvements back into controls, processes and the incident plan to prevent recurrence.
What is a root cause analysis (RCA), and name a common technique.
RCA is a structured method to identify the underlying cause of an incident rather than just its symptoms. A common technique is the '5 Whys' (repeatedly asking 'why'); others include fishbone/Ishikawa diagrams.
What is a 'post-incident report' expected to contain?
A timeline of events, what happened and its impact, the root cause, how it was detected and handled, decisions taken, and recommendations/actions for improvement.
What is the goal of digital forensics?
To identify, collect, preserve, analyse and present digital evidence in a manner that is legally sound and admissible, while maintaining its integrity.
What does ACPO guidance (UK) state as Principle 1 of computer-based electronic evidence?
No action taken should change data held on a computer or storage media which may subsequently be relied upon in court.
List the four ACPO principles of digital evidence (UK).
1) No action should change data that may be relied on in court. 2) If access to original data is necessary, the person must be competent and able to explain their actions. 3) An audit trail of all processes should be created and preserved. 4) The person in charge of the investigation is responsible for ensuring the law and principles are adhered to.
What is the 'chain of custody' and why is it critical to forensic evidence?
A documented, unbroken record of who collected, handled, transferred and stored evidence, and when. It is critical to prove the evidence has not been tampered with and to ensure admissibility in court.
Why are cryptographic hashes (e.g. of a disk image) used in digital forensics?
A hash provides a unique fingerprint of the data; recomputing it later and matching the original value proves the evidence has not been altered, demonstrating integrity.
Show the other 41 Business Continuity, Incident Management and Assurance flashcards
What is a 'write blocker' and why is it used in forensics?
A hardware or software device that allows read-only access to storage media so the original evidence cannot be modified during acquisition (supporting ACPO Principle 1).
What is the difference between 'volatile' and 'non-volatile' data in forensic acquisition, and which is collected first?
Volatile data (e.g. RAM contents, running processes, network connections) is lost on power-off; non-volatile data (e.g. disk) persists. Volatile data is collected first, following the 'order of volatility'.
Define Business Continuity Management (BCM).
A holistic management process that identifies potential threats to an organisation and the impacts to operations, and provides a framework for building resilience and the capability to respond effectively to safeguard interests, reputation, brand and value-creating activities.
Which ISO standard specifies requirements for Business Continuity Management Systems (BCMS)?
ISO 22301.
What is a Business Impact Analysis (BIA) and what does it determine?
A process that identifies critical business functions and the impact over time of their disruption. It determines recovery priorities and the key recovery objectives (RTO, RPO, MTPD/MAO).
Define Maximum Tolerable Period of Disruption (MTPD), also called MAO.
The maximum time that a critical business activity can be unavailable before the resulting impact threatens the organisation's survival or causes unacceptable harm.
Define Recovery Time Objective (RTO).
The target maximum time within which a business process or system must be restored after a disruption to avoid unacceptable consequences. RTO must be less than the MTPD.
Define Recovery Point Objective (RPO).
The maximum acceptable amount of data loss measured in time — i.e. the point in time to which data must be recovered. It dictates backup frequency.
State the relationship constraint between RTO and MTPD.
$RTO < MTPD$ — recovery must be achieved before the maximum tolerable period of disruption is reached, leaving a margin to resume normal service.
If an RPO is 4 hours, how frequently (at minimum) must backups occur, and why?
At least every 4 hours. The RPO sets the maximum tolerable data loss, so the backup interval must be no greater than the RPO to ensure recoverable data is never older than 4 hours.
What is the difference between Business Continuity and Disaster Recovery?
Business Continuity is the broad strategy keeping the whole organisation (people, processes, premises) operating during disruption. Disaster Recovery is a subset focused specifically on restoring IT systems, data and infrastructure.
Compare hot, warm and cold recovery sites.
Hot site: fully equipped and running, near-instant failover, highest cost. Warm site: partially equipped (hardware/connectivity) needing data/config restore, moderate cost/time. Cold site: empty space with power/utilities only, longest recovery, lowest cost.
What is the difference between a full, incremental and differential backup?
Full: copies all data. Incremental: copies only data changed since the last backup of any type (fast backup, slower restore). Differential: copies all data changed since the last full backup (slower backup, faster restore).
What is the '3-2-1' backup rule?
Keep 3 copies of data, on 2 different media types, with 1 copy stored off-site.
What is failover and failback?
Failover is switching operation to a standby/redundant system or site when the primary fails. Failback is returning operation to the primary system once it is restored.
What does 'high availability' typically refer to, and how is availability expressed as a percentage?
Designing systems to remain operational with minimal downtime via redundancy. Availability is $\text{Availability} = \frac{\text{Uptime}}{\text{Uptime} + \text{Downtime}} \times 100\%$, often expressed as 'nines' (e.g. 99.999%).
Approximately how much annual downtime does '99.999% (five nines)' availability allow?
About 5.26 minutes per year ($0.001\% \times 525{,}600 \text{ min/year} \approx 5.26$ minutes).
Why must business continuity and disaster recovery plans be regularly tested?
To validate that plans actually work, that recovery objectives (RTO/RPO) are achievable, to train staff, and to identify gaps before a real disaster occurs.
Compare a 'tabletop exercise' (desktop walkthrough) with a 'full-scale/live test' of a BC plan.
A tabletop exercise is a discussion-based walkthrough of the plan against a scenario — low cost, no disruption. A full-scale/live test actually invokes recovery (e.g. failing over to the DR site) — most realistic but costly and potentially disruptive.
Name the common escalating levels of BC/DR plan testing.
Plan review/checklist; tabletop (desktop) exercise; walkthrough/simulation; parallel test (recovery runs alongside live); and full interruption (live) test.
Why must BC and DR plans be maintained, and what events should trigger an update?
To keep them accurate as the organisation changes. Triggers include changes in business processes, technology, staff/contacts, suppliers, premises, after a test, or after a real incident.
How does incident management relate to information security's CIA triad?
Incidents threaten Confidentiality, Integrity and/or Availability. Incident management and business continuity primarily protect Availability (and Integrity), restoring service and limiting CIA breaches.
What is the relationship between business continuity and risk management?
Risk management identifies and assesses threats and their likelihood/impact; BCM is a treatment/response that builds resilience and recovery capability for risks that cannot be fully eliminated, especially high-impact disruptive ones.
Define 'security assurance'.
The grounds for confidence that an entity (system, control or organisation) meets its security objectives and that controls are correctly implemented, operating effectively and achieving the desired outcome.
Distinguish a vulnerability assessment from a penetration test.
A vulnerability assessment identifies and reports known weaknesses, typically using automated scanning, broad coverage, no exploitation. A penetration test actively attempts to exploit weaknesses to demonstrate real-world impact and depth.
What is the difference between an audit and a penetration test as assurance methods?
An audit checks compliance of controls/processes against a standard, policy or requirement (evidence-based review). A penetration test technically attacks systems to find and exploit exploitable security weaknesses.
Compare black-box, white-box and grey-box penetration testing.
Black-box: tester has no prior knowledge (simulates outsider). White-box: tester has full knowledge (source code, architecture, credentials). Grey-box: tester has partial knowledge (e.g. standard user access).
What is the UK 'Cyber Essentials' scheme and how does it relate to assurance?
A UK government-backed certification scheme defining baseline technical controls against common internet threats. Cyber Essentials is self-assessment; Cyber Essentials Plus adds independent technical verification, providing greater assurance.
What is the difference between a Type I and Type II assurance report (e.g. SOC reports)?
A Type I report assesses the design/suitability of controls at a point in time. A Type II report assesses both design and operating effectiveness of controls over a period of time, giving stronger assurance.
What is the role of internal audit versus external (independent) audit in security assurance?
Internal audit provides ongoing, in-house assurance to management on control effectiveness. External/independent audit provides objective, impartial assurance to stakeholders and can support certification or regulatory confidence.
In an investigation, why is it important to preserve evidence and follow due process before any disciplinary action?
To ensure findings are fair, defensible and legally sound — protecting evidence integrity, the rights of the accused, and avoiding unfair dismissal claims or rejection of evidence in court or tribunal.
What is the danger of acting on a suspected insider incident without HR and Legal involvement?
Improper handling can breach employment law and data protection rules, compromise evidence, expose the organisation to legal claims (e.g. unfair dismissal), and prejudice any subsequent prosecution.
What is the difference between a security 'metric' and a Key Performance Indicator (KPI)?
A metric is any measurement of a security attribute (e.g. number of incidents). A KPI is a selected metric tied to an objective/target that indicates how well a goal is being achieved.
Define Mean Time To Detect (MTTD) and Mean Time To Respond/Recover (MTTR).
MTTD is the average time taken to detect an incident after it occurs. MTTR is the average time taken to respond to and recover from an incident. $MTTR = \frac{\text{total recovery time}}{\text{number of incidents}}$.
What is a Key Risk Indicator (KRI) and how does it differ from a KPI?
A KRI is a forward-looking metric signalling increasing exposure to a risk (e.g. rising number of unpatched systems). A KPI measures performance against an objective. KRIs warn of risk; KPIs measure achievement.
Why should security metrics be tailored to their audience (e.g. technical team vs board)?
Different audiences need different detail and framing: technical teams need operational detail to act, while the board needs concise, business-risk-oriented information to make strategic and resourcing decisions.
What makes a security metric effective (a common set of criteria)?
It should be SMART-like: Specific, Measurable, Actionable/Achievable, Relevant and Timely — objective, repeatable, and clearly linked to a security objective or decision.
What is 'continual improvement' in an information security management context?
The ongoing, iterative enhancement of the ISMS, controls and processes — using feedback from audits, incidents, metrics and reviews to progressively reduce risk and improve effectiveness.
Describe the Plan-Do-Check-Act (PDCA) cycle and its role in continual improvement.
Plan: establish objectives and controls. Do: implement them. Check: monitor, measure and audit performance. Act: take corrective/improvement actions. The cycle repeats, driving continual improvement of the ISMS (e.g. in ISO/IEC 27001).
What is the difference between 'corrective action' and 'preventive action' in an ISMS?
Corrective action eliminates the cause of a detected nonconformity/incident to stop it recurring. Preventive action addresses potential causes to stop a problem occurring in the first place.
How do incident lessons learned, audit findings and metrics together drive continual improvement?
They provide evidence of weaknesses and trends; management review evaluates this input and authorises corrective/preventive actions and control changes, feeding the PDCA cycle to continually strengthen security.
CISMP (Certificate in Information Security Management Principles) Business Continuity, Incident Management and Assurance FAQ
What is in the CISMP (Certificate in Information Security Management Principles) Business Continuity, Incident Management and Assurance syllabus?
CISMP (Certificate in Information Security Management Principles) Business Continuity, Incident Management and Assurance is split into 3 chapters: Incident Management, Business Continuity and Disaster Recovery and Investigations, Assurance and Continual Improvement. Together they contain 12 topics and 18 sub-topics.
How many chapters are in CISMP (Certificate in Information Security Management Principles) Business Continuity, Incident Management and Assurance?
3 chapters, containing 12 topics and 18 sub-topics. The largest chapter is Incident Management, with 4 topics.
Are there flashcards for CISMP (Certificate in Information Security Management Principles) Business Continuity, Incident Management and Assurance?
Yes — a 61-card Business Continuity, Incident Management and Assurance deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.