Question

During a major data breach, the incident response team is fully engaged in containment and eradication activities. Several hours in, executive leadership, legal, and public relations begin independently reaching out to technical responders for updates, disrupting the technical work. The information security manager realizes the incident response plan lacked a critical component. Which element should have been defined in the plan to prevent this situation?

Accepted Answer

A communication plan that designates a single point of contact and defines stakeholder notification channels and cadence

Answer

A more detailed technical containment runbook for the affected systems

Answer

A revised incident severity classification matrix with additional tiers

Answer

An expanded chain-of-custody procedure for preserving forensic evidence