Question

During a tabletop exercise, a mid-sized company's IR team discovers they lack the specialized skills to conduct deep malware reverse-engineering and memory forensics for advanced attacks. Leadership wants to ensure that if a sophisticated breach occurs, expert help can be mobilized within hours rather than negotiating contracts during the crisis. Which preparation-phase action BEST addresses this gap?

Accepted Answer

Establish a pre-negotiated incident response retainer agreement with a third-party forensics firm

Answer

Purchase additional EDR licenses to expand endpoint visibility across the environment

Answer

Schedule quarterly vulnerability scans to identify weaknesses before an attacker does

Answer

Update the incident response communication tree with additional internal stakeholder contacts