Question

A mid-sized company recently suffered a ransomware incident. During the response, analysts wasted several hours debating who had authority to disconnect affected systems and how to escalate to legal and executive leadership. The CISO wants to ensure future incidents proceed with predefined, repeatable steps that assign roles and decision authority before an event occurs. Which preparation-phase activity most directly addresses this need?

Accepted Answer

Developing and maintaining incident response playbooks that document roles, escalation paths, and step-by-step actions for specific incident types

Answer

Conducting a root cause analysis of the ransomware infection vector after recovery is complete

Answer

Deploying an EDR solution capable of automatically isolating infected endpoints from the network

Answer

Increasing the frequency of vulnerability scans to detect exploitable weaknesses earlier