Certified Information Security Manager (CISM) — Question 1195

An organization experienced a data breach that affected many of its clients. Legal counsel found out about this event only after a press release was issued. Which of the following would have been MOST helpful in preventing this situation?

Answer options

• A. A gap analysis of technical controls
• B. Regular information security policy reviews
• C. Tabletop testing of the incident response plan
• D. A comprehensive business continuity plan (BCP)

Correct answer: C

Explanation

Tabletop testing of the incident response plan is crucial as it simulates a breach scenario, allowing the organization to identify weaknesses and improve communication protocols, including involving legal counsel promptly. The other options, while beneficial for security and preparedness, do not specifically address the need for timely legal awareness and coordination during an incident.