A hospital incident-response plan shows a cover logo and contains neither a contact list nor a severity guide. What is missing for NIST-style incident-response preparation?
Select an answer to reveal the explanation.
Short Explanation
A handsome cover still leaves you stuck when nobody knows whom to call. The hospital plan needs roles, contacts, and severity criteria before an incident starts. A bigger logo, a new cipher, or a spare firewall printout does not fill that gap.
Full Explanation
An incident plan has to tell people who acts, how to reach them, and how severe an event must be before they escalate. Named roles, a contact list, and severity criteria so staff know who acts and when, are the missing preparation pieces; contacts are the communications element, and severity criteria tell those roles which handling action the event calls for. A larger logo on the cover while the contact list and severity guide stay blank changes the artwork and leaves the plan unusable. A new cipher suite for the hospital VPN, unrelated to who is called in an incident, is a transport choice, not a plan element. A second printed copy of the firewall rules, adding no response contacts or severity guide, duplicates a control that is already written and still names nobody to call. Exam caveat: NIST SP 800-61 Rev. 3 maps the handling phases onto CSF 2.0 Functions, and the exam still expects those phase names plus plan elements such as purpose, scope, roles, and communications. Operational check: open the hospital plan and confirm it names roles, lists after-hours contacts, and states severity criteria the staff can apply without inventing them during the event.