A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the…

The incident review identified two distinct process failures: a lack of prioritization and an approval bottleneck. Introducing a priority rating for incident response workloads (A) directly addresses the failure to report due to high project workloads, ensuring security events are handled based on severity. Creating an executive team delegation plan (D) directly solves the six-hour delay caused by unavailable management. This plan empowers designated individuals to provide necessary approvals, ensuring the response is not stalled by the absence of a single person.

B. Phishing training is irrelevant; the team observed the activity but failed to report it due to workload, not a lack of awareness.
C. A risk audit is a broad assessment. The specific failures have already been identified, and direct, actionable solutions are required.
E. Automation does not solve the core human process issues identified: a lack of delegated approval authority and improper workload prioritization.

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide.

Section 2.3.2

Policies: This section emphasizes that incident response policies should "define which events are considered incidents

" which is the foundation for establishing a priority rating system (supports option A).

Section 2.4.1

Incident Response Team Structure: This section discusses the importance of the team having the necessary "authority to take actions

" which underscores the need for clear roles and delegation plans to prevent delays (supports option D).

2. Cisco

Incident Response: How to Prepare for and Respond to a Security Breach (White Paper).

Section: "Create an Incident Response Plan": The document states

"The plan should...define roles and responsibilities for the incident response team." This directly supports creating a delegation plan (D) to ensure someone is always available and authorized to act. It also advises the plan should "define what constitutes an incident

" which is essential for prioritization (A).

3. Carnegie Mellon University

Software Engineering Institute

CSIRT Development

"Establishing an Incident Management Capability."

Section: "Obtain Management Authority and Buy-In": This resource explains the necessity of pre-approved authority for the response team

stating

"The CSIRT needs the authority to perform its role and responsibilities... This can be accomplished by creating a policy that designates the CSIRT and describes its constituency

mission

and authority." This highlights the need for a formal delegation structure (supports option D).