What is a cybersecurity incident response plan and key steps in responding to a cyber incident?

• A. A plan for budgeting and staffing
• B. A structured plan for detecting, containing, eradicating, recovering, and learning from incidents
• C. A plan to dispose of old hardware
• D. A plan to implement new software

Answer: (B)

A cybersecurity incident response plan is a documented, repeatable process for handling cybersecurity incidents that guides actions from detection through recovery and beyond. It provides clear roles and responsibilities, established communication and escalation paths, and evidence-handling procedures so responses are coordinated, efficient, and auditable. The plan outlines the sequence of activities you perform when an incident occurs: preparation (setting up tools, contacts, playbooks, and training), identification and analysis (determining what happened and its scope), containment (short-term steps to stop spread and long-term steps to isolate affected systems), eradication (removing the root cause and artifacts such as malware or compromised credentials), recovery (restoring systems and services to normal operation with monitoring to confirm the threat is gone), and lessons learned (post-incident review to improve defenses and the response process). This framework helps minimize damage, preserve evidence for forensics, and drive continuous improvement.

Other IT tasks like budgeting and staffing, disposing of old hardware, or implementing new software are important, but they do not define the structured sequence and coordinated actions used to detect, contain, eradicate, recover from, and learn from cyber incidents.