Chapter 4 of 4 · ISACA CISM
Incident Management
Incident response plan, BIA, BCP and DRP, classification, testing, tools, investigation, containment, communications and review.
- 5topics
- 15 minfast track
- 2diagrams and exhibits
- 29%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Incident Response Plan and Incident ClassificationBuilding the incident response plan, team roles and escalation, and classifying incidents by severity and type so the response…Diagram3 min
- 2Business Impact Analysis, Continuity and Recovery PlansThe business impact analysis with RTO, RPO and maximum tolerable downtime, the continuity and disaster recovery plans, and how…Diagram3 min
- 3Incident Training, Testing and Response ToolsTraining incident teams, tabletop exercises, simulations and full tests, and response tools such as SIEM, EDR, SOAR and threat…3 min
- 4Incident Investigation, Evaluation and ContainmentInvestigating and evaluating security incidents, preserving evidence with chain of custody, and containment methods that limit…3 min
- 5Response Communications, Recovery and Post-Incident ReviewIncident communications, notification and escalation, eradication and recovery from clean sources, and post-incident reviews with…3 min
About this chapter
What this chapter covers
Incident Management is worth 29 percent of the CISM exam under the outline effective 3 November 2026 (30 percent under the 2022 outline). It covers how the organization prepares for security incidents and how it handles them when they happen, so that damage is limited, the business keeps running and lessons lead to improvement.
Readiness (4A) covers the incident response plan, the business impact analysis, the business continuity plan, the disaster recovery plan, incident classification and categorization, and training, testing and evaluation. Operations (4B) covers tools and techniques, investigation and evaluation, containment, response communications, eradication and recovery, and post-incident review.
How the topics fit together
Readiness work done in advance decides how well operations go on the day. The business impact analysis tells the team which systems matter most; the plans, tests and tools make a fast, controlled response possible.
For incident questions, check whether the scenario is about readiness (plans, testing, training) or a live response. In a live incident, the manager follows the plan, contains the damage and escalates as defined; improvising outside the plan is usually wrong.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.