An agency incident plan names who may speak to the public, who may isolate a system, and how leadership is notified. Which plan elements are those three statements?
Select an answer to reveal the explanation.
Short Explanation
A drill card earns its keep when it names who may address the crowd and who may shut a wing. Those statements in your agency plan are roles and communication paths. A flaw score, a flow template, or a cipher list does not hand anyone that authority.
Full Explanation
An incident plan has to say who is allowed to act and how word moves. Naming the person who may speak publicly, the person who may isolate a system, and the path used to tell leadership is that authority and notification model. Those statements are: Roles and communication paths covering public statements, isolation authority, and notices to leadership. A severity formula does not assign either duty. A CVSS calculator used only to produce a score for one software flaw on an agency server quantifies a vulnerability and never says who may talk to the public. A flow schema is a router concern. A NetFlow export template that lists router fields and does not name who may speak or who may isolate a host defines exported columns, not plan authority. Algorithm choice is a protocol concern. A cipher-suite list that names the algorithms one agency web server is willing to offer clients belongs in a TLS configuration, not in the incident plan's authority section. Exam caveat: roles and communications are plan elements alongside purpose and scope. NIST SP 800-61 Rev. 3 maps older handling phases onto CSF 2.0 Functions, and that mapping does not remove the need to name who may speak and who may isolate. Operational check: point to the plan section that names the spokesperson, the isolation authority, and the leadership notification path, and confirm each name is a role rather than a tool.