Question

An information security manager is finalizing the organization's incident response plan and wants to ensure that the effectiveness of the response process can be objectively evaluated over time. During plan development, which element is MOST important to define so that future incident performance can be meaningfully measured?

Accepted Answer

Predefined, measurable performance targets such as maximum detection and response times aligned to incident severity

Answer

The names and contact details of every member of the incident response team

Answer

A list of forensic tools approved for evidence collection during investigations

Answer

The escalation path for notifying executive management of major incidents