The CISO must resolve these three conditions: (1) directors have never practiced decisions involving ransom, disclosure, and service restoration; (2) leadership declares victory after restoring service without examining strategic failures; (3) customers, staff, and regulators require different timely messages after material disruption. Which THREE options directly satisfy these requirements? Choose THREE.
Explanation
Correct Answers
B:For the requirement that directors have never practiced decisions involving ransom, disclosure, and service restoration, an executive exercise rehearses strategic roles and trade-offs before a real crisis; Post-crisis executive review separately addresses the need that leadership declares victory after restoring service without examining strategic failures.
D:For the requirement that leadership declares victory after restoring service without examining strategic failures, a review revisits decisions, governance gaps, resilience, and improvement commitments; Executive war-game exercise separately addresses the need that directors have never practiced decisions involving ransom, disclosure, and service restoration.
E:For the requirement that customers, staff, and regulators require different timely messages after material disruption, a coordinated update plan tailors verified information to duties and audience needs; Executive war-game exercise separately addresses the need that directors have never practiced decisions involving ransom, disclosure, and service restoration.
Incorrect Answers
A:A validated situation report establishes agreed facts, uncertainty, and update cadence; its proper use case is one in which different teams circulate conflicting outage counts and speculative attack claims, not one in which directors have never practiced decisions involving ransom, disclosure, and service restoration; the other need in this item is that customers, staff, and regulators require different timely messages after material disruption.
C:A defined command structure clarifies tactical authority and coordination during disruption; that helps with the separate case where too many executives issue contradictory directions to incident responders, not with the issue that directors have never practiced decisions involving ransom, disclosure, and service restoration; the other need in this item is that customers, staff, and regulators require different timely messages after material disruption.
F:A decision log documents inputs, approvals, timing, and rationale for later accountability; deploying it would matter if high-stakes containment choices are made rapidly and nobody records why, but the deciding issue here is that directors have never practiced decisions involving ransom, disclosure, and service restoration; the other need in this item is that customers, staff, and regulators require different timely messages after material disruption.