Explain the role of incident response planning in the ISSAP discipline.

• A. Defines procedures for detecting, assessing, containing, eradicating, and recovering from security incidents, including roles, communications, and post-incident lessons.
• B. Only documents how to file insurance claims after an incident.
• C. Focuses on public relations response; not technical steps.
• D. Replaces security monitoring; eliminates the need for a SOC.

Answer: (C)

Incident response planning in this discipline covers the end-to-end process for handling security incidents. It defines the procedures for detecting and confirming incidents, assessing their scope and impact, containing and eradicating the threat, and recovering normal operations. It also lays out who does what (roles and responsibilities), how communications are managed with technical teams, management, legal, and other stakeholders, and how post-incident analysis is conducted to capture lessons learned and strengthen defenses. This planning is tightly integrated with ongoing security monitoring and the operations center, ensuring a prepared, coordinated, and repeatable response rather than a ad-hoc reaction. While public relations considerations may come into play during an incident, the plan must address technical steps, evidence handling, regulatory and legal considerations, and continuity of business functions. Insurance claims, while tangential in nature, do not define the IR lifecycle, and replacing monitoring or eliminating the need for a SOC would undermine the fundamental purpose of incident response.