Question

An information security manager is developing an incident response plan for an organization that already maintains a business continuity plan (BCP) and a disaster recovery plan (DRP). To ensure these plans work together effectively during a major disruptive cyber incident, which of the following is the MOST important action the manager should take?

Accepted Answer

Define clear activation triggers and escalation criteria that hand off between the incident response, business continuity, and disaster recovery plans

Answer

Ensure the incident response plan specifies the same recovery point objectives (RPO) already documented in the disaster recovery plan

Answer

Assign the incident response team leader as the owner of the business continuity and disaster recovery plans

Answer

Consolidate all three plans into a single document to eliminate duplicated procedures