Which of the following is NOT a component of an incident response policy?

An incident response policy is a high-level document that establishes the organization's framework, authority, and intent for managing security incidents. It typically includes the mission, scope, roles and responsibilities (C), communication plans, and escalation procedures (A). It also mandates the creation and maintenance of detailed incident handling procedures (B).

However, detailed backup and recovery processes (D), while essential for the recovery phase of incident handling, are not a direct component of the incident response policy itself. These technical procedures are typically documented in a separate, more detailed Disaster Recovery Plan (DRP) or Business Continuity Plan (BCP), which the incident response plan may reference and activate.

A. Escalation procedures: This is a critical component, defining the pathway for reporting and elevating an incident based on its severity to ensure appropriate levels of management and technical staff are involved.

B. Incident handling procedures: The policy provides the authority and framework for creating and implementing the specific, step-by-step procedures for handling incidents (e.g., identification, containment, eradication, recovery).

C. Roles and responsibilities: This is a fundamental element of the policy, clearly defining who is responsible for specific actions during an incident to ensure a coordinated and efficient response.

1. NIST Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 2.3.1, "Incident Response Policy," lists the typical elements of an IR policy. These include a statement of management commitment, scope, definition of incidents, organizational structure, roles, responsibilities, and prioritization. It does not include detailed technical processes like backup and recovery, which are part of the operational recovery phase that uses separate plans.

2. Carnegie Mellon University, Software Engineering Institute, Defining Incident Management Processes, CMU/SEI-2004-TN-028. This technical note outlines the necessary processes for incident management. It discusses the need for a policy to establish authority and define roles (p. 11, Section 3.1.1), and it separates the incident handling lifecycle from the detailed technical implementation of recovery, which would rely on pre-existing disaster recovery or continuity plans.

3. Cisco, Security Policy: A Best Practices White Paper. This document describes the hierarchy of security documentation. A policy is a high-level statement of intent. The detailed "how-to" steps, such as backup and recovery processes, would be documented in lower-level procedural documents, not in the overarching policy itself (See section "Security Policy Hierarchy").