An information security manager is preparing an incident response plan. Which of the following is the MOST important consideration when responding to an incident involving sensitive customer data?
A. The assignment of a forensics team
B. The ability to recover from the incident in a timely manner
C. The ability to obtain incident information in a timely manner
D. Following defined post-incident review procedures
The Correct Answer is D. Following defined post-incident review procedures.
Generally, after every security incident has occurred, the information security manager is to preapre a detailed incident response plan. The plan consist of various instructions on hoe to detect the incidents, not only dectecting but also it provides instructions to respond and recover from various type of security incidents.
These plans also addresses issues like data losses, outages, etc. While preparing an incident response plan, the information security manager must consider many things like list of critical data recovery processes, business continuity plan, etc. Of all the ones present, when dealing with sensitive data, the manager must follow the defined post incident review procedures.
The procedures help us understand on how the incident has occurred, what were the effects, and many other things related to the incident.
Therefore, the answer is Option D. Following defined post-incident review procedures.