A newly hired information security manager finds a well-written incident response plan that has never been approved by senior management. Responders report that business units ignore their containment requests. What should the manager do FIRST?

Authority in incident response comes from governance. Senior management approval establishes the plan as an organizational mandate, gives responders the right to take containment actions that affect business operations and signals to business units that cooperation is expected. Since the plan is already well written and the problem is that units ignore responders, approval addresses the root cause directly. Adding more detailed containment procedures improves the technical content but leaves responders without the authority to apply them. A tabletop exercise is valuable for testing, but exercising a plan that lacks a mandate does not change how business units respond to real requests, and testing usually follows approval. Bilateral memoranda with each business unit are a fragmented substitute for organizational authority; they are slow to collect, inconsistent and can be withdrawn, and they still lack senior management backing. Exam caveat: approval should be renewed when the plan changes materially, so the mandate stays current. Operational check: confirm the approved plan records the approving executive and date, states the authority granted to the incident manager, and has been communicated to business unit leaders.