CISM: Certified Information Security Manager

Question

An employee clicked a link in a phishing email, which triggered a ransomware attack. Which of the following should be the information security manager do FIRST?

Explanation

Ransomware response begins with containment. Isolating the impacted endpoints immediately limits the malware’s ability to spread across the network or communicate with external infrastructure before notification, investigation, or recovery actions occur.

CISM: Certified Information Security Manager

AstroTutor

Notes

Readiness

QuestionQ26

Community Discussion