CISM: Certified Information Security ManagerDemo

Question

An organization suffered a data breach that impacted many of its clients. Legal counsel learned of the incident only after a press release had been issued. Which of the following would have been MOST helpful to prevent this situation?

A A gap analysis of technical controls
B Regular information security policy reviews
C Tabletop testing of the incident response plan
D A comprehensive business continuity plan (BCP)

Explanation

Tabletop testing of the incident response plan validates notification, escalation, and communications procedures across incident stakeholders. It would reveal that legal counsel must be engaged before public disclosure or press releases are issued.

CISM: Certified Information Security ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ478

Community Discussion