Home / CPA Course / ISC

Incident response

ISC Chapter 16 · Area II · Blueprint II.D

Area II ends where every security program is finally judged: the night something goes wrong. At 2:14 a.m. on a Saturday, Brightwater's file server starts encrypting itself. This chapter follows that night and the weeks after. Priya and Sam separate ordinary events from real incidents, see how cyber insurance shares the cost, read the incident response plan that tells everyone who does what and by when, walk the response step by step, and then test, as auditors, whether Brightwater actually followed its plan. You will finish able to read an incident timeline and spot exactly where the response drifted from the plan.

In this chapter

1. Events, incidents and breaches
2. Cyber insurance as a mitigation strategy
3. The incident response plan
4. The response, step by step
5. Testing whether the response followed the plan
6. Learning from incidents: metrics and improvement

This chapter has 6 lessons, 50 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

• Events versus incidents
• cyber insurance
• the incident response plan
• testing the response

Chapter 15: Confidentiality and privacy · Chapter 17: SOC engagements: types, users and criteria