At a manufacturer, a production line must be isolated now and restarted later. Besides the SOC, who has to take part in containment and recovery for that line?
Select an answer to reveal the explanation.
Short Explanation
The person who can stop the machine is the one who can start it again. You need the system owner beside the SOC when a production line must be isolated and later restarted. The trap is leaving that action with the receptionist, a news editor, or a certificate vendor.
Full Explanation
Containment, eradication, and recovery include actions that change a business system, such as isolating it and later returning it to service. A SOC can recommend the isolation, and someone with authority over the line has to take it down and bring it back. That person is The system owner who can take the line down and later bring it back up. Without that owner, the technical recommendation and the operational act come apart. Only the front-desk receptionist, with no authority over the production line can greet visitors and cannot isolate or restore the process. Only an external news editor, with no authority over the production line handles public wording and has no plant control. The certificate vendor, who has no access to isolate or restart the line may supply a certificate and still cannot touch the line. Exam caveat: containment and recovery include the people who can actually change the affected system, not every outsider who hears about the event. Operational check: name the system owner in the incident plan for that line and confirm the on-call path reaches that owner before you rely on the SOC alone to halt and restore production.