Question

A CyberOps analyst is helping draft the organization's incident response capability. The team lead emphasizes that before any tools are purchased or procedures written, senior leadership must formally approve funding, define the CSIRT's authority, and endorse the IR policy. In terms of NIST SP 800-61 management concepts, why is securing this executive commitment considered foundational to an effective incident response program?

Accepted Answer

Management support and buy-in establish the authority, resources, and policy mandate that enable the IR team to operate across the organization

Answer

Management approval is required only to complete the lessons-learned report after an incident closes

Answer

Executive commitment primarily determines which CVSS base score threshold triggers containment

Answer

Leadership endorsement is only needed to authorize the forensic imaging of volatile memory during collection