Certified Information Security Manager (CISM) — Question 1126

Which of the following BEST enables an incident response team to determine appropriate actions during an initial investigation?

Answer options

• A. Technical capabilities of the team
• B. Feedback from affected departments
• C. Historical data from past incidents
• D. Procedures for incident triage

Correct answer: D

Explanation

The correct answer is D because having established procedures for incident triage allows the team to systematically assess the situation and prioritize responses effectively. While technical capabilities, feedback from departments, and historical data are valuable, they do not provide the structured approach necessary for immediate decision-making like triage procedures do.