CISM - Incident Management - Section 4.1

Establish and maintain an incident response plan aligned with the business continuity plan and disaster recovery plan.

Establish and maintain an incident response plan (IRP) that is explicitly aligned with the organisation's business continuity plan (BCP) and disaster recovery plan (DRP) to ensure a coordinated response to disruptive events. Recognise that misalignment between these plans creates gaps in coverage and conflicting recovery priorities.

Incident response planIRP alignmentBCPDRP

Practice question for this objective

Free sampleIncident Managementmedium

An information security manager is establishing a new incident response plan and wants to ensure it interlocks correctly with the existing business continuity and disaster recovery plans. Which element should the incident response plan define so that the business continuity plan and disaster recovery plan are invoked at the right moment?

AThe detailed alternate-site rebuild runbooks that engineers follow once failover has been authorised.
BThe annual budget and licensing schedule for the security monitoring tools used to detect incidents.
CThe criteria and thresholds that classify an incident's severity and trigger invocation of the business continuity and disaster recovery plans. Correct
DThe full list of regulatory breach-notification templates to be sent to data protection authorities.

Use severity classification and invocation thresholds in the incident response plan to trigger the business continuity and disaster recovery plans. Alignment depends on a clear handover: the incident response plan classifies severity and sets thresholds that, when crossed, invoke the business continuity and disaster recovery plans. Defining those criteria ensures continuity and recovery activate at the correct moment rather than too early or too late.

Why A is wrong: Rebuild runbooks are valuable, but they belong to the disaster recovery plan's execution detail; they do not define when that plan should be invoked.

Why B is wrong: Tool budgets support detection capability, but they are a resourcing matter and play no part in deciding when the business continuity or disaster recovery plans are triggered.

Why C is correct: Severity classification and invocation thresholds in the incident response plan are the handover point; they determine precisely when the business continuity and disaster recovery plans are activated, making this the interlocking element.

Why D is wrong: Notification templates are a genuine incident response output, which makes them tempting, but they govern external communication, not the threshold that invokes the continuity and recovery plans.

See more CISM practice questions, answers explained.

More in this domain

Back to all Incident Management objectives, or the CISM cert hub.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.