Which of the following is an element of an incident response plan?

An incident response plan is a formal, documented set of policies and procedures to be followed in the event of a security breach. A core element of this plan is the development of specific security policies that define what constitutes an incident, establish the authority and roles of the incident response team, and outline the required communication and reporting procedures. These policies form the foundation of the plan, providing a clear framework and set of rules for a structured and effective response, ensuring all actions are pre-approved and aligned with organizational goals.

A. Installing antivirus software: This is a preventative technical control used to protect systems, not a procedural element within the incident response plan document itself.

B. Conducting regular backups: This is a crucial data recovery and business continuity practice, but it is an operational task, not a component of the response plan's documented procedures.

D. Identifying vulnerabilities: This is a proactive security assessment activity (vulnerability management) aimed at preventing incidents, distinct from the reactive measures outlined in a response plan.

1. NIST Special Publication 800-61 Rev. 2, "Computer Security Incident Handling Guide":

Section 2.3, "Incident Response Policy, Plan, and Procedure Creation," Page 8: This section explicitly states, "An incident response policy is the foundation of an incident response program... The policy should define what is meant by the term ‘incident’... Once the policy is in place, a plan for handling incidents can be developed." This establishes that policy development is a foundational element of the plan.

2. Cisco, "What Is an Incident Response Plan (IRP)?" (Official Documentation/Blog):

Section: "What are the key elements of an incident response plan?": Cisco documentation outlines that a plan must include "Policy, plan and procedure." It specifies that the plan should be based on a clear policy that grants the response team the authority to act, defining the rules of engagement and overall goals for the incident response effort.

3. SANS Institute, "The Incident Handler's Handbook":

Section: "Preparation," Page 4: This authoritative guide, widely referenced in academic and professional settings, details the Preparation phase of incident response. It lists creating policies and procedures as a primary step, stating, "Policies are needed to empower people to act... The incident response plan is the operational document that guides the actions of the handlers." This confirms that policy creation is integral to the plan.