CISM Domain 4: Incident Management (30%)

Overview

Incident Management covers preparing for and handling information security incidents so that business impact stays within acceptable limits. Part A, Incident Management Readiness, spans the incident response plan, business impact analysis (BIA), business continuity plan (BCP), disaster recovery plan (DRP), incident classification and categorization, and training, testing and evaluation. Part B, Incident Management Operations, covers tools and techniques, investigation and evaluation, containment methods, response communications, eradication and recovery, and post-incident review practices.

Candidates must think as the manager who owns the capability rather than the analyst at the keyboard. You need to know why the BIA drives recovery objectives, who has authority to declare and escalate, how to contain without destroying evidence, and how lessons learned feed back into risk and the program. Domain 1 supplies authority and escalation paths, Domain 2 supplies impact ratings, and Domain 3 supplies the controls and monitoring that detect incidents.

Why it matters on the exam

At 30% this is the second heaviest domain, and its questions punish answers that are technically sensible but managerially out of order. Candidates with operational backgrounds jump to eradication before containment, restore systems before preserving evidence, or notify the public before following the communication plan. Others confuse the BIA with a risk assessment, or recovery time objective with recovery point objective, and then mis-sequence recovery. Because readiness is built on outputs from the other domains, such as asset criticality, ownership and provider contracts, weak understanding here also exposes gaps from earlier study. Strong command of sequencing and authority converts directly into points on one of the most heavily weighted parts of the exam.

How it's tested

Domain 4 questions are sequencing and authority scenarios. An alert, an outage, a ransomware note, a failed recovery test or a notification deadline is described, and you choose what to do FIRST, NEXT or MOST importantly. Look for the incident phase, the business impact and who holds authority, then pick the step the plan defines for that moment.

Sequence the response

An event is under way. You order validation, classification, containment, evidence preservation, eradication, recovery and review correctly, choosing the step that limits further impact at that moment.
Readiness inputs

A plan is being built or updated. You identify which input comes first, such as the BIA for recovery priorities or classification criteria for escalation.
Who communicates what

Stakeholders, regulators, customers or media need information. You choose the communication that follows the plan, uses the designated spokesperson and meets legal timelines.

Reasoning it through

Ransomware is found encrypting a file server that holds customer records. Options are to restore from backup, wipe the server, isolate it from the network or notify customers. The immediate goal is to stop the spread while keeping evidence, so isolating the server is first; restoring or wiping now risks reinfection and destroys evidence, and customer notification follows assessment of what data was affected and what the law requires.

Sub-topics 12

Official sub-topics from the ISACA outline, in outline order.

4.1 Incident Response PlanThe documented plan that defines how incidents are handled and by whom.

What it means: The incident response plan (IRP) defines scope, roles, authority to declare incidents, escalation paths, phases of response, communication procedures and links to the BCP and DRP.
What to understand: The plan is approved by senior management and aligned to business priorities, so responders do not have to negotiate authority during a crisis. It names the incident response team, external contacts such as legal counsel, forensic firms and regulators, and decision points such as when to involve law enforcement.
How it shows up: Responders disagree during an incident about who can shut down a production system, and the question asks what would have prevented this: a plan with defined authority and escalation approved in advance.
Common confusion: Treating the IRP as a technical runbook; it is a management document that defines authority, roles and decisions as well as procedures.

4.2 Business Impact Analysis (BIA)Determining which processes matter most and how quickly they must recover.

What it means: A BIA identifies critical business processes, the impact of their disruption over time (financial, operational, legal, reputational), their dependencies, and the resulting recovery objectives such as maximum tolerable downtime (MTD), recovery time objective (RTO) and recovery point objective (RPO).
What to understand: The BIA is driven by business process owners, not IT, and it sets recovery priorities that the BCP and DRP must meet. Unlike a risk assessment, it assumes disruption occurs and measures consequence, regardless of likelihood.
How it shows up: A question asks what should be done FIRST when developing a BCP or DRP, or what determines recovery priorities: the BIA.
Common confusion: Mixing up the BIA and the risk assessment; the BIA focuses on impact over time, while risk assessment weighs likelihood and impact to choose controls.

4.3 Business Continuity Plan (BCP)Keeping critical business processes running during and after disruption.

What it means: The BCP describes how critical business functions continue at an acceptable level during a disruption, through alternate processes, sites, staff and suppliers, until normal operations resume.
What to understand: BCP is business-wide and focused on processes and people, while the DRP is a subset focused on restoring technology. The incident response plan connects to the BCP through defined triggers, so a security incident that threatens critical processes invokes continuity arrangements.
How it shows up: A scenario describes a prolonged outage of a critical process and asks which plan governs keeping the business operating: the BCP, with the DRP restoring the supporting systems.
Common confusion: Treating BCP and DRP as the same document; DRP restores IT, BCP keeps the business functioning.

4.4 Disaster Recovery Plan (DRP)Restoring technology and data to meet recovery objectives.

What it means: The DRP sets out how IT systems, infrastructure and data are restored after a disruption, including recovery sites, backup strategies, restoration order and responsibilities.
What to understand: Recovery strategies are chosen to meet RTO and RPO from the BIA at acceptable cost: hot sites support short RTOs at high cost, warm sites trade cost for longer recovery, and cold sites are cheapest but slowest. Backup frequency and replication determine achievable RPO.
How it shows up: A system has a four-hour RTO and the current recovery option is a cold site, and the question asks what the manager should do: present a recovery option that meets the RTO, or the gap, to the business owner.
Common confusion: Picking a recovery site by cost alone rather than by the RTO and RPO the BIA requires.

4.5 Incident Classification/CategorizationRating incidents by type and severity to drive escalation and response.

What it means: Classification assigns incidents to categories, such as malware, unauthorized access, data loss or denial of service, and severity levels based on business impact, data sensitivity and scope.
What to understand: Predefined criteria let responders escalate consistently and quickly, so the right people and resources engage at the right level. Severity is driven by impact on the business and on regulated data, not by technical novelty, and it is revisited as facts emerge.
How it shows up: Two incidents occur at once, one technically sophisticated on a test system and one simple on a system holding regulated data, and the question asks which to prioritize: the one with greater business impact.
Common confusion: Ranking severity by technical complexity rather than by business impact.

4.6 Incident Management Training, Testing and EvaluationProving the plans work and the people can carry them out.

What it means: This covers training responders and stakeholders, and testing plans through checklist reviews, tabletop exercises, simulations, parallel tests and full interruption tests, then evaluating results.
What to understand: Test types progress from low-risk paper reviews to high-risk full interruption, which can itself cause an outage and needs strong justification and senior approval. Each test should have objectives, documented results and tracked corrective actions, and plans are retested after significant changes.
How it shows up: A newly written plan has never been exercised, and the question asks the BEST first test: a tabletop or walkthrough that validates roles and steps without disrupting operations.
Common confusion: Assuming a full interruption test is the best first test because it is the most realistic.

4.7 Incident Management Tools and TechniquesTechnology and methods for detecting, analyzing and coordinating response.

What it means: Tools include security information and event management (SIEM), endpoint detection and response (EDR), intrusion detection systems, security orchestration, automation and response (SOAR), forensic toolkits, ticketing and secure out-of-band communication channels.
What to understand: Tools support the process but do not replace it; they need tuning, integration with log sources and trained staff. Out-of-band communication matters when the primary network or email may be compromised.
How it shows up: Attackers may be reading corporate email during an incident, and the question asks the BEST way for the team to coordinate: a predefined out-of-band channel.
Common confusion: Believing buying a SIEM or SOAR platform establishes an incident capability without process and people.

4.8 Incident Investigation and EvaluationEstablishing what happened, how and with what impact, while preserving evidence.

What it means: Investigation determines scope, root cause, affected assets and data and attacker actions, while evaluation measures business impact and informs decisions on notification, escalation and recovery.
What to understand: Evidence must be collected in a way that preserves admissibility: documented chain of custody, collection in order of volatility (memory before disk) and work on forensic copies. Legal counsel should be involved early when litigation, regulatory action or law enforcement is possible.
How it shows up: A compromised server may be needed in legal proceedings, and the question asks what to do before rebuilding it: capture forensic images with chain of custody.
Common confusion: Rebooting or reimaging a system to stop an attack, which destroys volatile evidence.

4.9 Incident Containment MethodsLimiting the spread and impact of an incident.

What it means: Containment limits damage through isolation of hosts, network segmentation, disabling compromised accounts, blocking malicious domains or addresses and, in some cases, shutting down services.
What to understand: Containment decisions balance stopping the damage against business disruption and evidence preservation, and the authority to take systems offline should be defined in the plan. Short-term containment buys time, while longer-term containment keeps the business running safely until eradication.
How it shows up: Malware is spreading from a workstation to file servers, and the question asks what to do FIRST after confirming the incident: isolate affected systems.
Common confusion: Going straight to eradication, such as deleting malware, before containing the spread.

4.10 Incident Response Communications (e.g., Reporting, Notification, Escalation)Getting the right information to the right people at the right time.

What it means: Communications cover internal escalation to management, reporting to the board, notification to regulators, customers and partners, and coordination with media through designated spokespeople.
What to understand: External notifications follow legal and contractual timelines and are coordinated with legal counsel and corporate communications, using templates prepared in advance. Messages must be accurate, so the team avoids speculation and only authorized people speak externally.
How it shows up: A journalist calls a responder about a suspected breach, and the question asks the BEST action: refer the call to the designated spokesperson under the communication plan.
Common confusion: Assuming the security manager should notify regulators or the public directly without legal and executive involvement.

4.11 Incident Eradication and RecoveryRemoving the cause and restoring normal operations safely.

What it means: Eradication removes the root cause and attacker footholds, such as malware, backdoors and compromised credentials, while recovery restores systems and data to normal operation and verifies they are clean.
What to understand: Recovery should restore from known-good backups taken before the compromise, patch the exploited weakness and monitor closely for reinfection. Restoration order follows BIA priorities, and the business owner confirms that systems are fit to return to service.
How it shows up: A system was restored from the latest backup and was reinfected within hours, and the question asks what was MOST likely missed: verifying that the backup predated the compromise and removing the root cause.
Common confusion: Treating restore from the most recent backup as automatically safe.

4.12 Post-incident Review PracticesLearning from incidents to improve controls, plans and risk decisions.

What it means: A post-incident review, or lessons-learned session, examines what happened, how well the response worked, root causes and what should change, and records corrective actions with owners and dates.
What to understand: The review is blameless in tone but specific in outcome, and its findings update the risk register, controls, plans, training and metrics. It should happen soon after closure while details are fresh, and its value lies in tracked follow-through.
How it shows up: Similar incidents keep recurring, and the question asks what is MOST likely missing: effective post-incident reviews whose corrective actions are tracked to completion.
Common confusion: Treating the review as a report filed for compliance rather than a source of changes to risk and controls.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Recovery time objective (RTO)

The target time within which a process or system must be restored after disruption, set by the BIA.

Remember
RTO is about time to restore service; it must be shorter than the maximum tolerable downtime.

Tested as
Drives the choice of recovery site and strategy.

Trap
Confusing it with RPO, which concerns data loss.
Recovery point objective (RPO)

The maximum acceptable amount of data loss measured in time, which sets how far back restored data may be.

Remember
An RPO of one hour needs backups or replication at least hourly.

Tested as
Drives backup frequency and replication choices.

Trap
Thinking a short RTO automatically means a short RPO.
Maximum tolerable downtime (MTD)

The longest a process can be unavailable before the organization suffers unacceptable harm, sometimes called maximum tolerable period of disruption.

Remember
RTO plus time to verify and resume must fit within MTD.

Tested as
Used to judge whether a recovery strategy is adequate.

Trap
Setting RTO equal to MTD, which leaves no margin.
Service delivery objective (SDO)

The level of service that must be maintained during an alternate or recovery mode until normal operations resume.

Remember
SDO defines how much capacity is acceptable while degraded.

Tested as
Appears with RTO and RPO in recovery planning items.

Trap
Assuming full capacity must be restored at once.
BIA vs. risk assessment

The BIA measures impact of disruption over time regardless of cause; the risk assessment weighs likelihood and impact to select controls.

Remember
BIA comes first when building BCP and DRP.

Tested as
FIRST-step questions on continuity planning.

Trap
Starting continuity planning with a threat assessment.
Containment before eradication

Stop the spread and limit damage before removing the cause.

Remember
Isolate, preserve evidence, then eradicate and recover.

Tested as
Sequencing questions during active incidents.

Trap
Wiping or patching affected systems while the attacker still moves laterally.
Chain of custody

Documented record of who collected, handled and stored each item of evidence, when and how.

Remember
Gaps in custody can make evidence inadmissible.

Tested as
Investigation questions where legal action is possible.

Trap
Letting several people handle evidence without logging transfers.
Order of volatility

Collect the most volatile evidence first, such as memory and running processes, before disk images and logs.

Remember
Powering off loses memory contents.

Tested as
Asked when deciding what to collect first.

Trap
Shutting down a compromised host before capturing memory.
Incident declaration authority

The plan names who can declare an incident and authorize disruptive containment such as taking a system offline.

Remember
Authority is set in advance by senior management.

Tested as
Questions where responders hesitate or argue during response.

Trap
Assuming the most senior technician can decide.
Plan test types

Checklist review, tabletop or walkthrough, simulation, parallel test and full interruption test, in increasing realism and risk.

Remember
Parallel runs the recovery site alongside production; full interruption shuts production down.

Tested as
BEST-test questions for new or changed plans.

Trap
Choosing full interruption for a first test.
Recovery sites

Hot sites are fully equipped and ready within hours; warm sites have partial equipment; cold sites provide space and utilities only.

Remember
Match the site to the RTO, not to the budget alone.

Tested as
DRP strategy questions.

Trap
Accepting a cold site for a system with a very short RTO.
Out-of-band communication

Channels separate from the possibly compromised environment, such as dedicated phones or a separate messaging platform.

Remember
Arrange them before an incident.

Tested as
Coordination questions when email or network may be monitored by attackers.

Trap
Coordinating response over corporate email during an intrusion.
Post-incident review outputs

Root cause, response effectiveness, corrective actions with owners and updates to risk, controls and plans.

Remember
Value comes from tracked corrective actions.

Tested as
Recurring-incident and improvement questions.

Trap
Using the review to assign blame.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

RTO vs. RPO vs. MTD

Concept	Meaning	Key difference	Common trap
Recovery time objective (RTO)	Target time to restore a process or system after disruption.	Measures downtime; drives recovery site and staffing choices.	Using it to set backup frequency.
Recovery point objective (RPO)	Maximum tolerable data loss measured back from the disruption.	Measures data loss; drives backup and replication frequency.	Assuming it is met because RTO is met.
Maximum tolerable downtime (MTD)	Longest outage before harm becomes unacceptable to the business.	Upper limit set by the business; RTO must fit within it.	Treating MTD and RTO as the same number.

Incident response plan vs. BCP vs. DRP

Concept	Meaning	Key difference	Common trap
Incident response plan	How security incidents are detected, assessed, contained, eradicated and reviewed.	Focused on the security event and its handling.	Expecting it to restore whole business operations.
Business continuity plan	How critical business processes continue during disruption.	Business-wide, covering people, processes, sites and suppliers.	Treating it as an IT document.
Disaster recovery plan	How technology and data are restored to meet RTO and RPO.	Technology-focused subset that supports the BCP.	Believing a DRP alone keeps the business running.

Tabletop vs. simulation vs. parallel vs. full interruption tests

Concept	Meaning	Key difference	Common trap
Tabletop or walkthrough	Participants talk through a scenario and their roles.	No systems touched; lowest risk; good first test.	Expecting it to prove technical recovery works.
Simulation	A realistic scenario is played out with responders acting, without real recovery.	Tests decisions and coordination under time pressure.	Treating results as proof of recovery capability.
Parallel test	Recovery systems are brought up and run alongside production.	Validates recovery without stopping production.	Forgetting to compare outputs with production results.
Full interruption	Production is shut down and operations move to recovery arrangements.	Most realistic and most risky; needs senior approval.	Choosing it for an untested plan.

Containment vs. eradication vs. recovery

Concept	Meaning	Key difference	Common trap
Containment	Limit spread and damage, for example by isolating hosts or disabling accounts.	Stops the incident from growing; comes first.	Skipping it to fix systems sooner.
Eradication	Remove malware, backdoors, compromised credentials and the exploited weakness.	Removes the cause after the scope is known.	Starting before scope is understood and missing footholds.
Recovery	Restore systems from known-good sources and return them to service with monitoring.	Returns operations to normal after eradication.	Restoring from a backup that already contains the compromise.

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Restore immediately

What candidates pick
Restoring affected systems from backup as soon as an incident is confirmed.

Why it looks right
It returns the business to service quickly, which seems to minimize impact.

Why it's wrong
Without containment and root cause, restored systems can be reinfected, and evidence on the affected systems may be destroyed.

Clue to watch for The attack is still active or its scope is unknown.
Power off the compromised host

What candidates pick
Shutting down a compromised server to stop the attack.

Why it looks right
It stops activity instantly and feels decisive.

Why it's wrong
Powering off loses volatile evidence such as memory and network connections; network isolation contains the threat while keeping evidence.

Clue to watch for Legal action, regulators or forensic investigation are mentioned.
Start continuity planning with threats

What candidates pick
A threat or risk assessment as the first step in building a BCP.

Why it looks right
Risk assessment is the starting point for many security activities.

Why it's wrong
Continuity planning starts with the BIA, which identifies critical processes and recovery objectives regardless of cause.

Clue to watch for A stem asking what comes FIRST in developing a BCP or DRP.
Most realistic test first

What candidates pick
A full interruption test to validate a new plan.

Why it looks right
It gives the most realistic evidence that the plan works.

Why it's wrong
An untested plan can fail and cause a real outage; tabletop and walkthrough tests come first.

Clue to watch for The plan is new, recently changed or has never been exercised.
Technical sophistication sets priority

What candidates pick
Prioritizing the most advanced attack among concurrent incidents.

Why it looks right
Sophisticated attacks feel more dangerous and interesting.

Why it's wrong
Priority follows business impact and data sensitivity defined in classification criteria.

Clue to watch for Two incidents with different affected assets, one holding regulated or critical data.
Security manager speaks for the company

What candidates pick
The security manager notifying customers or the media directly.

Why it looks right
The manager knows the facts best and wants transparency.

Why it's wrong
External communication follows the plan through designated spokespeople with legal counsel, meeting legal timelines with accurate information.

Clue to watch for A media inquiry, regulatory deadline or customer notification requirement.
Latest backup is safe

What candidates pick
Restoring from the most recent backup to minimize data loss.

Why it looks right
It best meets the RPO.

Why it's wrong
If the compromise predates the backup, restoring it reintroduces the attacker; the backup must be verified as clean.

Clue to watch for Dwell time is unknown or reinfection occurred after restore.

Answer framework

Use this sequence whenever a Domain 4 scenario asks what to do FIRST or NEXT during or before an incident.

Identify whether the scenario is in readiness (planning, BIA, testing) or operations (an active event), because the correct first steps differ.
For readiness, start from the BIA and business priorities, then confirm plans define authority, escalation and recovery objectives.
For an active event, validate and classify it by business impact, then contain the spread while preserving evidence.
Communicate through the plan: escalate internally, involve legal counsel and use designated spokespeople for external notification within required timelines.
Eradicate the root cause, recover from known-good sources in BIA priority order, then run a post-incident review whose actions update risk, controls and plans.

Practice question

During a routine review, a security analyst finds that an attacker has had access to an internal database server for several weeks. The server holds customer payment data. The attacker's access appears to be active. What should the information security manager do FIRST?

Restore the database server from the most recent backup Notify affected customers that their payment data may be exposed Contain the attacker's access while preserving evidence, following the incident response plan Conduct a post-incident review to identify the root cause

Show the answer

Answer C. The access is active, so containment under the incident response plan comes first, with evidence preserved for investigation and possible legal action. Restoring from backup is the strongest distractor, but after weeks of access the latest backup may contain the compromise and restoration would destroy evidence. Customer notification follows investigation and legal guidance, and the review comes after recovery.

Want more like this? The CISM practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Study readiness before operations, in outline order. Begin with the incident response plan and the BIA, because both set the authority and priorities every later step relies on. Learn MTD, RTO, RPO and SDO with numeric examples until you can explain which strategy each one drives. Then cover BCP and DRP together, using the comparison table to keep their scopes separate, and finish Part A with classification criteria and test types.

For Part B, memorize the response sequence as a chain: detect and validate, classify, contain while preserving evidence, communicate under the plan, eradicate, recover and review. Most Domain 4 questions test a link in that chain, so practice saying why each step must precede the next.

Commonly underestimated areas are communications and post-incident review. Candidates treat them as administrative, yet the exam asks who may notify regulators, how to handle media and what makes lessons learned effective. Review evidence handling too: chain of custody and order of volatility appear in investigation scenarios.

Afterwards, work timed sets of FIRST and NEXT questions, and for every miss write the phase you were in and the step you skipped. Then return to Domain 2 to see how BIA results and incident lessons update the risk register.

FAQ

Is Domain 4 technical?

It tests management decisions about incidents, such as sequencing, authority and communication. You need to know what tools and forensic practices do, not how to operate them.

What is the most common question style here?

FIRST and NEXT sequencing questions during an incident, and FIRST-step questions when building or testing plans.

What is the difference between RTO and RPO?

RTO is the target time to restore service; RPO is the maximum acceptable data loss measured in time. RTO drives recovery site choices, while RPO drives backup and replication frequency.

Why does the BIA come before the BCP?

The BIA identifies critical processes and their recovery objectives. Without it, the BCP and DRP cannot set priorities or choose strategies that meet business needs.

Who should notify regulators or customers after a breach?

The designated roles in the communication plan, coordinated with legal counsel and senior management, within the timelines the applicable law or contract sets.

How long should I study Domain 4?

Our planning estimate is about 50–70 hours within a 200-hour plan, reflecting its 30% weight.

How does incident management connect to the other domains?

Governance defines authority and escalation, risk management supplies impact ratings and receives lessons learned, and the program provides the controls and monitoring that detect and contain incidents.

Related domains

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Overview

How it's tested

Sequence the response

Readiness inputs

Who communicates what

Sub-topics 12

High-yield concepts

Recovery time objective (RTO)

Recovery point objective (RPO)

Maximum tolerable downtime (MTD)

Service delivery objective (SDO)

BIA vs. risk assessment

Containment before eradication

Chain of custody

Order of volatility

Incident declaration authority

Plan test types

Recovery sites

Out-of-band communication

Post-incident review outputs

Side by side

RTO vs. RPO vs. MTD

Incident response plan vs. BCP vs. DRP

Tabletop vs. simulation vs. parallel vs. full interruption tests

Containment vs. eradication vs. recovery

Exam traps

Restore immediately

Power off the compromised host

Start continuity planning with threats

Most realistic test first

Technical sophistication sets priority

Security manager speaks for the company

Latest backup is safe