Certified Information Security Manager (CISM) — Question 870

Which of the following is the GREATEST concern resulting from the lack of severity criteria in incident classification?

Answer options

• A. The service desk will be staffed incorrectly.
• B. Timely detection of attacks will be impossible.
• C. Statistical reports will be incorrect.
• D. Escalation procedures will be ineffective.

Correct answer: D

Explanation

The lack of severity criteria can lead to ineffective escalation procedures because incidents may not be prioritized correctly. This can result in critical issues not being addressed promptly, while less severe incidents may receive undue attention. The other options, while concerning, do not directly impact the effectiveness of escalation procedures as significantly as this issue.