An information security manager is developing the organization's first formal incident response plan. During a tabletop discussion, several managers argue over who has the authority to shut down a production system during an active incident. To prevent this confusion from recurring during a real event, what should the security manager address FIRST in the plan?