Certified Information Security Manager (CISM) Practice Exam

In the context of an incident response plan, the key components typically include preparation, containment, eradication, recovery, and post-incident review. Each of these components plays a critical role in effectively managing and responding to security incidents.

Preparation involves establishing and training an incident response team, developing policies, and ensuring that tools and resources are in place before an incident occurs. Containment focuses on limiting the impact of an incident while it is happening. Eradication refers to removing the threat and mitigating vulnerabilities that led to the incident, while recovery is about restoring systems and services back to normal operations. Finally, a post-incident review is essential for learning from the incident, which helps improve future responses.

Access control, while vital for overall cybersecurity management, does not specifically fit within the framework of an incident response plan. It is primarily about restricting who can access what resources within an organization and does not directly pertain to the procedures for responding to an incident after it has occurred. Therefore, while access control is an important aspect of security practices, it is not considered a key component of an incident response plan. This distinction clarifies why access control is not part of the formal structure of incident response plans and emphasizes the focus on handling and learning from incidents.