CISM: Certified Information Security ManagerDemo

By Isaca · Question Mode

QuestionQ396

Incident Management

Which of the following should an information security manager do FIRST after being told that customer data was breached in a third-party vendor's environment?

  • A Communicate the breach to leadership.
  • B Request and verify evidence of the breach.
  • C Notify the incident response team.
  • D Review vendor obligations in the contract.
Explanation

The breach should be substantiated with reliable evidence before the organization activates broader response communications or takes actions based on the report. Verification establishes that an actual incident occurred and provides the factual basis for an appropriate response.

Community Discussion

No comments yet. Be the first to start the discussion!