The Incident Response Lifecycle for CISM and CISA

2026-10-19

Incident management is about 30% of CISM and a significant part of CISA Domain 5. Most questions test sequence and authority.

The lifecycle

A widely used model, described in NIST SP 800-61, groups incident handling into four stages:

1. Preparation — plans, roles, tools, contacts, training and exercises.
2. Detection and analysis — identify events, confirm incidents, determine scope and severity.
3. Containment, eradication and recovery — stop the spread, remove the cause, restore operations safely.
4. Post-incident activity — lessons learned and improvements.

Sequencing rules the exam tests

• Contain before you recover. Restoring onto an infected network spreads the problem.
• Preserve evidence while you contain. Capture volatile data before powering down when legal action is possible.
• Eradicate before you restore. Remove the root cause and persistence first.
• Restore to a clean point. Choose backups from before the initial compromise.
• Monitor after recovery. Watch for the attacker's return.

Who decides what

• The incident response plan defines roles, escalation and decision authority — define them before the incident.
• High-impact containment, such as shutting down a revenue-critical system, is a business decision informed by the response team.
• External communications go through designated, approved roles, with legal input.
• Ransom and law enforcement decisions belong to senior management with legal counsel.

Classification and escalation

Severity follows business impact, not the technical cause. Classify early, escalate by defined criteria, and reclassify as facts change.

The post-incident review

• Held soon after resolution.
• Blameless, focused on causes and improvements.
• Corrective actions assigned, tracked and verified.
• Lessons fed back into risk assessments and plans.

CISA versus CISM perspective

• CISA asks how an auditor evaluates incident management — plans, escalation criteria, logging, evidence handling — and reports gaps.
• CISM asks how a manager builds and runs the capability and makes decisions during an incident.

Related on Auditor Path

• Contain, then recover, then learn
• Chain of custody
• Order of volatility
• NIST SP 800-61

Sources

ISACA CISM exam content outline, Domain 4; ISACA CISA exam content outline, Domain 5 Part B; NIST SP 800-61.