CISM: Certified Information Security ManagerDemo

Question

Following a major information security incident, which of the following would BEST assist an information security manager in determining corrective actions?

A Preserving the evidence
B Performing an impact analysis
C Calculating cost of the incident
D Conducting a postmortem assessment

Explanation

A postmortem assessment identifies root causes, response gaps, and lessons learned, providing the basis for corrective actions that prevent recurrence and improve incident handling.

CISM: Certified Information Security ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ170

Community Discussion