CISM: Certified Information Security ManagerDemo

Question

An employee has just reported losing a personal mobile device that contains corporate information. Which action should the information security manager take FIRST?

A Initiate incident response.
B Initiate a device reset.
C Conduct a risk assessment.
D Disable remote access.

Explanation

Loss of a device containing corporate information is a potential security incident and should trigger the incident-response process. That process coordinates assessment and containment, which may include disabling remote access or remotely wiping the device when appropriate. NIST’s incident-response guidance treats containment as part of incident handling and emphasizes selecting containment actions based on the incident’s circumstances.

Learn more

NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management

CISM: Certified Information Security ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ402

Community Discussion