Exam CISM topic 1 question 155 discussion

The correct answer is D. At intervals indicated by industry best practice. An incident response plan should be reviewed regularly to ensure that it is up-to-date and effective. While recovery time objectives (RTOs) and missing information can be important considerations for reviewing the plan, they are not the most important criteria for determining when to review it. Instead, industry best practices recommend that incident response plans should be reviewed and updated on a regular basis, such as annually or bi-annually, to ensure that they remain relevant and effective in response to the evolving threat landscape. Therefore, option D is the most appropriate choice.

B. When missing information impacts recovery from an incident This is most important because it creates an unknown that must be verified. When there is missing information that impacts recovery from an incident it makes it very important to review the incedent response plan to ensure that everything will work accordingly to achieve the desired goals and objectives.

An incident response plan must be accurate, complete, and actionable during a real incident. If missing or outdated information (like contact details, escalation paths, or procedures) impairs the organization's ability to respond or recover, then the plan is not effective — and must be reviewed and updated immediately.

Definitely not D

You should review the plan regularly, not until issues happen (A&B).

I still think the answer is A when the RTO is not met by your IRP. Although the RTO is based on recovery but this recovery happens after an incident . It's the incident Reponse plan that dictates how recovery efforts will be done. If the recovery efforts don't satisfy the RTO it means the Restoration phase in the Incident Response Plan would need to be reviewed. Hence; i think it's A.

All answers suck and are incomplete in their own way. However, A and B are related to DR not IRP. So the closest to correct answer would be D. We can use industry best practice for this.

A and B are not part of an incident response plan. They are part of a Disaster recovery plan.

D is best practice and should be put in place but if critical information are missing, this call for an immediate review.

Industry best practices are out the window when you have missing information that prevents recovery. good choices are A and B - but RTO delay is not as critical as missing information

RTO is the most urgent reason

D is the right answer, it should get impacted by other options it should be done on intervals

I'll have to find the answers to the questions with multiple responses. I don't like that there are many divided responses. I wish wrong answers could be banned.

Between A and D i would choose D not because i like the answer but because RTO is related to DRP and not IRP .

A is correct. No one's going to wait for an annual review as suggested by some stuffy guy who writes standards and has no clue what's going on in the real world. If a company is missing their RTO's you think they will just wait until the yearly review comes around to check their plan? No way. Any good ops org is measuring this daily in aggregate, and at an incident by incident level. If patterns arise showing consistently lacking RTO's, you better believe they're gonna be reviewing things weekly at a minimum. If not, it's going to be someone's ass.

The correct answer is D. At intervals indicated by industry best practice.

At intervals indicated by industry best practice.