The organization bought a new forensic analysis tool six months ago, and management expects the internal incident response team to operate it without vendor help. No responder has used it yet. What should the security manager do to BEST improve readiness?
Select an answer to reveal the explanation.
Short Explanation
A tool nobody has practised with is like a parachute you've never unpacked. You don't want the first try to be the real jump. Paperwork about the tool won't build skill; training and exercises will.
Full Explanation
Readiness depends on people being able to use the capabilities the organization has invested in, under pressure and to an evidentiary standard. A forensic tool that responders have never operated introduces risk during a real incident: mistakes can alter evidence, delay analysis and undermine legal defensibility. Hands-on training builds the skill, and including the tool in exercises verifies that responders can apply it within the plan's procedures and timeframes, with gaps fed back into further training. Recording licence and support details is good asset management, but it does nothing to build competence, and management has said vendor help is not the intended operating model. Listing the tool in the plan and announcing it by email makes the team aware that it exists without giving anyone the ability to use it correctly. Deferring its use until the next annual plan revision leaves a paid-for capability idle and keeps the team unprepared for incidents that will not wait for the revision cycle. Exam caveat: training, testing and evaluation are treated as one readiness cycle, so new tools, roles or procedures should trigger both training and exercising. Operational check: confirm training records show each responder has used the tool and that the next exercise includes an evidence-handling task that requires it.