Domain 4: Incident Management

CISM · about 29% of the exam

Getting ready for incidents and disasters, then detecting, containing, communicating, recovering and learning when they happen.

Incident readiness

Event vs Incident vs Breach The vocabulary of incident management: what separates an event from an incident and an incident from a breach, why the distinctions matter legally and operationally, and how incident management differs from business continuity.
Developing the Incident Response Plan How the security manager builds an incident response plan: its purpose, contents, the life cycle it supports, and how it aligns with business continuity and disaster recovery plans.
Incident Response Team Roles and Authority Who belongs on the incident response team, what each role does, how teams are structured and staffed, and why authority must be agreed before an incident.
Incident Classification and Severity Levels How incidents are categorised by type and rated by severity, so the right people respond at the right speed, and how classification supports reporting and trend analysis.
Incident Response Playbooks and Decision Trees How playbooks translate the incident response plan into specific, repeatable steps for common incident types, with clear decision points, owners and escalation.
Escalation and Communication Plans How the security manager plans incident communications in advance: escalation paths and timings, internal and external audiences, approved templates, and secure channels that still work during an attack.

Business Impact Analysis How the BIA identifies critical business processes, measures how disruption hurts over time, sets recovery priorities and objectives, and maps the dependencies that recovery needs.
RTO, RPO, MTD and Recovery Prioritisation The recovery objectives that come out of the BIA, what each one drives, and how the security manager balances recovery speed against cost.
Business Continuity Planning and Strategies How business continuity keeps critical processes running through disruption: the BCP life cycle, strategies for losing sites, IT, people or suppliers, and how the BCP fits with incident response and DR.
Crisis Management and Continuity Governance How organisations manage a crisis at executive level: the strategic-tactical-operational structure, the crisis team's decisions, and the governance that keeps continuity plans current.

Disaster Recovery Planning How the DRP restores IT systems and data to meet the BIA's objectives: its contents, recovery teams, the link to incident response, and the special challenge of recovering from cyberattacks.
Recovery Sites: Hot, Warm and Cold The options for where to recover (mirrored, hot, warm, cold, cloud, reciprocal), how fast and costly each is, and what the security manager checks before relying on one.
Backup Strategies and Cloud DR How backups and replication meet the RPO, why ransomware changed backup strategy, the 3-2-1-1-0 rule, and how cloud services are used for disaster recovery.

Incident Response Training How the security manager prepares people for incidents: what each audience needs, how responders build and keep skills, and how training links to plans, playbooks and exercises.
Testing Plans: Tabletop, Functional and Full Interruption How incident response, continuity and recovery plans are tested, from checklist reviews and tabletops to simulations, parallel tests and full interruption, and how to plan a test safely.
Evaluating Exercises and Improving Readiness How to turn exercises into real improvement: observing, debriefing, measuring against objectives, reporting, and tracking fixes until the plan is proven to work.

Security Event Detection and Monitoring Methods How incidents are detected: monitoring sources, signature and behaviour-based detection, the role of people and third parties, and how the security manager measures and improves detection.
SIEM, the SOC and Event Correlation The tools and team that turn logs into detected incidents: how a SIEM correlates events, how a security operations centre is organised, and what the security manager must decide about them.
Threat Intelligence and Indicators of Compromise How threat intelligence and indicators of compromise feed detection and investigation, why some indicators matter more than others, and how to share intelligence safely.
Incident Triage and Initial Investigation How a reported event is validated, classified, scoped and prioritised quickly, and how the investigation that follows establishes what happened while preserving evidence and meeting legal requirements.
Evidence Preservation, Forensics and Chain of Custody How the security manager makes sure incident evidence is collected, preserved and handled so it can be used in court, by regulators or by insurers, and when to bring in forensic specialists.

Containment Strategies: Short-Term and Long-Term How to stop an incident spreading: fast short-term containment, longer-term isolation and segmentation, and doing it without destroying evidence or causing more harm than the attack.
Making Containment Decisions How hard containment choices are made: weighing the harm of acting against the harm of waiting, who decides, monitoring versus immediate action, and documenting the decision.
Breach Notification and Regulatory Reporting What organisations must report, to whom and how fast after a breach, how the security manager builds notification into the plan, and why legal leads the decisions.
External Communications: Customers, Media and Law Enforcement How an organisation communicates with customers, partners, the media and law enforcement during an incident: principles, spokespeople, timing, and decisions about involving the authorities.

Eradication, Recovery and Return to Normal Operations How the attacker and their tools are removed, how systems are restored and validated as clean, and how the organisation safely returns to normal operations.
Post-Incident Review and Root Cause Analysis How the post-incident review turns an incident into improvement: building the timeline, finding root causes, deciding corrective actions with owners and dates, and reassessing risk.
Lessons Learned and Incident Trend Analysis How lessons from individual incidents become organisational knowledge, how trend analysis reveals patterns no single incident shows, and how both feed back into risk, the program and the plans.