Incident Management · Topic 5 of 5
Response Communications, Recovery and Post-Incident Review
Incident communications, notification and escalation, eradication and recovery from clean sources, and post-incident reviews with root cause analysis.
- 3 min
- One spokesperson; pre-approved, legally checked messages.
- Track legal notification deadlines from awareness.
- Eradicate everywhere; restore from clean sources; monitor after recovery.
What it is
Response communications keep the right people informed during an incident, from executives to regulators and customers. Eradication and recovery remove the cause and restore normal operations safely. The post-incident review examines what happened and how the response went, so the organization improves.
How it works
Communications
| Audience | Purpose |
|---|---|
| Incident team and IT | Coordinate actions |
| Senior management and board | Escalation, decisions, business impact |
| Legal and compliance | Notification duties, evidence, liability |
| Regulators | Notification where the law requires it, within its time limits |
| Customers and affected individuals | Notification and guidance where required or appropriate |
| Media and public | Through an authorized spokesperson only |
| Law enforcement | When crime is suspected, decided with legal counsel |
| Suppliers and partners | When they are affected or involved |
Good practice: one authorized spokesperson, pre-approved templates, messages checked by legal and communications, facts rather than speculation, and secure or out-of-band channels if email may be compromised. Notification deadlines in laws and contracts often run from the moment the organization becomes aware of the incident, so they are tracked from then.
Eradication
Eradication removes the cause: malware, attacker accounts and persistence mechanisms, and the vulnerability or misconfiguration that allowed entry. It should cover every affected system found during investigation, otherwise the attacker returns.
Recovery
- Restore systems from known clean sources: verified backups, rebuilt images.
- Change credentials that may have been exposed.
- Return systems to production in stages, by business priority from the BIA.
- Monitor closely for signs of reinfection.
- Business owners confirm that systems and data are working correctly before closure.
Post-incident review
Held soon after the incident while details are fresh, with all involved parties. It covers:
- Timeline of the incident and the response.
- Root cause analysis.
- What worked and what did not in detection, containment, communications and recovery.
- Cost and impact.
- Actions to improve controls, the plan, training and tools, each with an owner and due date.
- Reassessment of related risks in the risk register.
The review is blameless in tone, focused on improving the system rather than punishing individuals.
When the same type of incident keeps recurring, the missing step is usually an effective post-incident review that fixes the root cause and tracks the actions to completion.
How the exam asks about this
- "Different managers are giving journalists different answers." Use a communication plan with one authorized spokesperson.
- "Systems were restored but the attacker returned." Eradication was incomplete or restoration used compromised sources.
- "What is the MAIN purpose of a post-incident review?" To identify root causes and improvements so incidents are prevented or handled better.
What to remember for the exam
- One spokesperson; pre-approved, legally checked messages.
- Track legal notification deadlines from awareness.
- Eradicate everywhere; restore from clean sources; monitor after recovery.
- Business owners confirm recovery before closure.
- Post-incident reviews find root causes and assign tracked actions.
Announcing full details or blaming a cause before the facts are confirmed can mislead customers and regulators and create legal exposure.
Common mistakes
Letting anyone speak to the media.
Closing the incident before monitoring confirms no reinfection.
Holding a review without tracking its actions.
Check yourself
Who should speak to the media during an incident?
Only the authorized spokesperson named in the plan.
Why must recovery use known clean sources?
Restoring from compromised backups or images can reintroduce the attacker or malware.
What should a post-incident review produce?
Root causes and improvement actions with owners and due dates, plus updates to plans and risk assessments.
Topic 5 of 5 in Incident Management
Test yourself on Incident Management
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.