D4: Incident Management

• Incident response plan (IRP) development

  CISM expects a security manager to own the creation, maintenance, and testing of the IRP, not just execute it. Plans that exist but have never been tested are treated as a significant program weakness on the exam.

• Business Impact Analysis (BIA)

  The foundational exercise that determines RTO/RPO and criticality for every business process. CISM treats the BIA as the input that everything else (BCP, DRP, resource prioritization) is built from.

• Testing types for continuity plans

  Tabletop/walkthrough (discussion-based, lowest cost/disruption), then simulation, then parallel test (alternate systems run alongside production), then full interruption (highest assurance, highest risk/cost). Know the tradeoffs of each.

• Roles during an incident

  Incident commander, communications/PR, legal, and technical responders each have distinct responsibilities. CISM tests whether you know who should be making which decisions, especially around external communication and legal notification obligations.

• Business Impact Analysis (BIA) vs. Risk Assessment

  A risk assessment identifies threats and vulnerabilities and estimates likelihood/impact. A BIA specifically determines the operational and financial impact of a disruption to a given business process over time, independent of what caused it: the BIA is what actually drives RTO/RPO.

• Tabletop exercise vs. full interruption test

  A tabletop is a low-cost, discussion-based walkthrough of the plan with no live systems affected. A full interruption test actually takes production systems down to validate the plan under real conditions: highest assurance but also highest business risk, used sparingly.

Sources: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide; NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems