A bank incident plan states which kinds of events count as incidents and which systems the plan covers. Which element of the plan is that statement?
Select an answer to reveal the explanation.
Short Explanation
The first page of a binder tells you what the binder is allowed to cover. Stating which events count as incidents and which systems are included is the scope of your bank plan. A detection clock, a hash list, or a VLAN map cannot replace that page.
Full Explanation
Scope and definitions tell analysts when the plan applies. The bank states which event types count as incidents and which systems are inside that boundary, so people do not invent a private definition during a live event. That statement is: Scope and definitions for the event types that count as incidents and the systems the plan covers. A timer is a metric, not the plan. The SOC time-to-detect clock treated as the whole incident plan for the bank, with no other element included collapses the document to one measurement and drops the question of what the plan even covers. No numeric target is required to see that mismatch. A list of file fingerprints is an indicator set. A malware hash list kept as the only document inside the bank incident-response plan can help a detector and still says nothing about which events or systems the plan includes. A network drawing is narrower still. A VLAN map that documents bank subnet segmentation and nothing about how incidents are handled shows addressing and does not define an incident. Exam caveat: on this exam the plan elements include purpose, scope, roles, and communications. NIST SP 800-61 Rev. 3 maps handling work onto CSF 2.0 Functions, and analysts still need a written scope so they know what the plan applies to. Operational check: read the opening section and confirm it names in-scope event types and in-scope systems, separate from any detection-time metric.