CISM Domain 4 · Incident Management

Exam

CISM

Exam weight

30% (29% from 3 Nov 2026)

What it covers

Incident response plans, BIA, BCP and DRP, classification, training and testing, tools, investigation, containment, communications, eradication, recovery and post-incident review.

What the exam rewards

Defined roles and decision authority
Containment balanced with business impact
Evidence preserved
Lessons tracked to closure

Common traps

Restoring before containing
Analysts deciding on business-critical shutdowns alone
Ad hoc external communication

Official subtopics

Incident Management Readiness

Incident Response Plan
Business Impact Analysis (BIA)
Business Continuity Plan (BCP)
Disaster Recovery Plan (DRP)
Incident Classification/Categorization
Incident Management Training, Testing and Evaluation

Incident Management Operations

Incident Management Tools and Techniques
Incident Investigation and Evaluation
Incident Containment Methods
Incident Response Communications (e.g., Reporting, Notification, Escalation)
Incident Eradication and Recovery
Post-Incident Review Practices

How to study it

Learn the incident sequence and who decides at each step, then practice communication and escalation scenarios.