A consultant is helping a small firm draft its incident response plan and explains which element gives the plan its practical value during a crisis. Which item is a core component that an incident response plan should contain?
- AA marketing schedule describing when new product features will be announced to customers during the year.
- BA depreciation table showing the accounting book value of each server over its expected service life.
- CDefined roles, responsibilities and communication procedures for the people who will handle an incident. Correct
- DThe individual passwords for every administrator account stored in the body of the document.
Why A is wrong: A product announcement schedule is unrelated to handling incidents and would never appear as a component of a response plan.
Why B is wrong: Asset depreciation is a finance record; while asset inventories help, a depreciation schedule does not guide incident handling and is not a plan component.
Why C is correct: A usable plan must state who does what and how they will communicate, because clear roles and escalation paths are what let a team act quickly and consistently under pressure.
Why D is wrong: This is tempting because responders need access, but embedding live credentials in the plan is a serious security flaw, not a legitimate required component.