Certified in Risk and Information Systems Control (CRISC) — Question 372

Which of the following is MOST important to include in a report for senior management after resolving a significant IT incident?

Answer options

• A. Incident resolution time and likelihood of recurrence
• B. A list of impacted business functions and estimated business loss
• C. Details of resolution methods and assessment of the incident
• D. A detailed information security root cause analysis

Correct answer: B

Explanation

The correct answer, B, is vital because senior management needs to understand the business impact of the incident. While the other options provide useful information, they do not directly address the financial and operational consequences that are critical for strategic decision-making.