SSCP Systems Security Certified PractitionerIncident Response and RecoveryMedium
During a post-incident review, an organization determines that the incident response team struggled to communicate effectively and follow established procedures due to outdated contact information and poorly defined roles. Which component of the incident response plan (IRP) should be updated to address these issues?
- ARecovery procedures
- BCommunication plan
- CContainment strategies
- DForensic analysis guidelines
Show answer & explanationAnswer & explanation
Correct answer: B. Communication plan
Outdated contact information and poorly defined roles directly impact the communication plan, which outlines how information is shared and who is responsible for specific actions during an incident.
Why the other options are wrong
- A. Recovery procedures focus on restoring systems and data after an incident.
- C. Containment strategies detail technical steps to limit incident scope.
- D. Forensic analysis guidelines focus on evidence collection and examination, not team communication.
Incident Communication Plan
A component of the Incident Response Plan (IRP) that defines how information will be shared with internal and external stakeholders during and after a security incident.
- Includes contact lists and escalation paths.
- Defines who communicates what, when, and to whom.
- Crucial for coordinated and effective response.
Memory trick: The IRP is a playbook; communication is the huddle.