A security manager proposes that a checklist review be this year's only test of the incident response plan. Senior management asks what assurance that review will actually provide. Which answer is MOST accurate?

A checklist review is the least disruptive and least rigorous form of plan testing. Reviewers compare the plan against a list of required elements and confirm that contact details, escalation paths, roles, inventories and referenced resources are present and current. Its value is in catching stale or missing content cheaply, which is why it is often the first step in a testing program. It does not exercise people, processes or technology, so it cannot generate evidence about performance. Claiming that it shows recovery within recovery time objectives is wrong because timing can only be measured when recovery steps are performed. Claiming it validates the alternate site's capacity confuses documentation with a parallel or full interruption test, where processing is actually moved. Claiming it demonstrates executive decision-making confuses it with a scenario-based tabletop exercise in which leaders must make and justify decisions. Exam caveat: a checklist review is appropriate as one layer of a testing program, but as the sole annual test it leaves management without evidence that the plan works. Operational check: map each plan objective to the test type that can evidence it, and report to management which objectives the current schedule leaves untested.