During a recent ransomware incident, responders argued over who could authorize taking systems offline, who would contact legal counsel, and in what order to act. Which preparation activity BEST prevents this confusion in future incidents?
Select an answer to reveal the explanation.
Short Explanation
If you're arguing about who's in charge in the middle of a fire, the house burns down. A playbook settles who decides, who calls legal, and what happens first - before anything's on fire. Better tools and backups are nice, but they don't fix a people-and-process problem. That's the trap.
Full Explanation
Preparation is the incident response phase in which the organization establishes the capability to respond: policies, communication plans, tools, training, and playbooks. A playbook for a scenario such as ransomware lays out the ordered steps for detection, containment, communication, and recovery, and the associated role definitions assign decision authority, for example who may approve taking production systems offline, who engages legal counsel, and who communicates with executives and outside parties. That directly addresses the confusion over authority and sequence. Purchasing more backup storage can shorten recovery, but it does not tell anyone who decides when to disconnect systems or call counsel. A vulnerability scan identifies weaknesses that might be exploited and supports prevention, yet it has no bearing on responder coordination. Deploying endpoint detection and response improves detection and blocking, which is valuable, but a tool cannot resolve disputes about authority during an incident. Exam caveat: playbooks are only effective when people know them, which is why preparation also includes training and exercises that rehearse the documented roles. Operational check: confirm the ransomware playbook names a decision owner for each critical action with a backup, and verify the contact details for legal and executive stakeholders are current.