Before any incident at a bank, someone must write the incident plan, the contact tree, and the severity guide. Whose stakeholder role owns that preparation work?

Preparation is the phase before an incident. The stakeholders who write the plan, the contact tree, and the severity guide sit in that phase, led by the incident-response lead with legal and communications. Live triage, a facilities repair, and a customer report are other moments. "The incident-response lead, with legal and communications, writing those items during preparation". Those three people write the plan, the contact tree, and the severity guide before an incident, which is preparation. "The night-shift analyst performing live triage on bank alerts that have already fired tonight". Live triage of alerts that have already fired is detection and analysis on shift. It is not authorship of the plan before any incident. "The facilities vendor whose only on-site task is replacing a failed badge reader at the operations door". Replacing a badge reader is facilities maintenance. That vendor is not writing the incident plan or the contact tree. "The customer who received a phishing message and forwarded that message to the bank help desk". A customer who forwards a phishing message is reporting a message they received. That report is not the pre-incident plan, contact tree, or severity guide. Exam caveat: the exam places these roles beside NIST SP 800-61 and names CMMC, with no practice identifier required. Rev. 3 maps the phases onto CSF 2.0 Functions and is not limited to those four names. Operational check: confirm the plan, contact tree, and severity guide name the lead, legal, and communications before the incident.