Question

During a preparation-phase review, a CySA+ analyst is asked to clarify the difference between the organization's incident response playbooks and its runbooks so that documentation ownership can be assigned. Which statement most accurately describes how these two artifacts differ in scope and use?

Accepted Answer

A playbook defines the high-level strategy and decision workflow for responding to a category of incident, while a runbook provides the specific step-by-step technical procedures used to execute individual tasks.

Answer

A playbook contains only automated SOAR actions, while a runbook contains only manual actions performed by analysts.

Answer

A runbook governs the entire incident response lifecycle across all incident types, while a playbook applies to a single system or application.

Answer

A playbook is a legally binding regulatory document, while a runbook is an informal set of notes maintained by individual analysts.