SCENARIO Please use the following lo answer the next QUESTIO N: The board risk committee of your organization is particularly concerned not only by…

The core issue identified is an outdated Incident Response Plan (IRP) leading to inconsistent and slow responses. Making the IRP a "live document" that is evaluated and updated after each incident directly addresses this root cause. This practice embeds a "lessons learned" process into the incident response lifecycle, ensuring the plan continuously evolves and improves based on real-world application. This proactive approach mitigates the risk of the plan becoming obsolete and ineffective, thereby improving the consistency and efficiency of future incident responses, which is the board's primary concern.

B. Make copies of the IRP in various places so it can be accessed remotely or when offline.

This addresses accessibility, which is important, but it does not solve the fundamental problem of the plan itself being outdated and ineffective.

C. Add comments about incidents to the IRP to record what action was taken.

This is poor practice. The IRP is a procedural document; incident-specific details belong in a separate incident log or post-mortem report, which then informs updates to the plan.

D. Make sure that everyone listed in the IRP has a copy of the IRP.

This addresses distribution. While necessary, providing everyone with a copy of a flawed and outdated plan will not improve the quality or speed of the response.

1. IAPP Official Textbook: Densmore

R. (2021). Privacy Program Management: Tools for Managing Privacy Within Your Organization

3rd ed. International Association of Privacy Professionals. In Chapter 6

"Privacy Operational Life Cycle: Respond

" the text emphasizes the importance of the post-incident phase

stating

"The final phase of the incident response plan is post-incident activity... This phase includes a 'lessons learned' session... The incident response plan should be updated to reflect any changes." (p. 203). This directly supports treating the plan as a live document that is evaluated and updated after incidents.

2. Official Vendor Documentation (NIST): National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.4

"Post-Incident Activity

" highlights that a key part of this phase is "using information gained during the incident to better prepare for handling future incidents." It explicitly recommends

"Creating a follow-up report... provides a reference that can be used to improve security measures and the incident handling process itself." (p. 41). This aligns with the principle of evaluating the plan's completeness during each incident to drive improvement.