Which item is NOT required to be included in the incident response plan under 12.10.1?

Which item is NOT required to be included in the incident response plan under 12.10.1?

• A. Detailed marketing and branding guidelines.
• B. Roles, responsibilities, and communication strategies including notification of payment brands.
• C. Specific incident response procedures.
• D. Business continuity and recovery procedures.

Answer: (D)

Focusing on what an incident response plan should cover, 12.10.1 emphasizes organizing who does what, how to communicate during an incident, and the concrete steps to detect, contain, eradicate, and recover from a security event, including who needs to be notified (such as payment brands). This keeps the plan tightly aligned with handling the incident itself and its immediate aftermath. Business continuity and recovery procedures deal with keeping critical operations running and restoring services after an incident. Those concerns belong to a separate business continuity/disaster recovery framework rather than the incident response plan, so they are not required to be included in 12.10.1’s incident response plan.

Focusing on what an incident response plan should cover, 12.10.1 emphasizes organizing who does what, how to communicate during an incident, and the concrete steps to detect, contain, eradicate, and recover from a security event, including who needs to be notified (such as payment brands). This keeps the plan tightly aligned with handling the incident itself and its immediate aftermath.

Business continuity and recovery procedures deal with keeping critical operations running and restoring services after an incident. Those concerns belong to a separate business continuity/disaster recovery framework rather than the incident response plan, so they are not required to be included in 12.10.1’s incident response plan.