A city SOC wants to avoid improvising during the next water-utility incident. Which investment best reflects the preparation phase of IR?

Preparation is the incident response phase that builds capacity before an alert ever fires. For a city water-utility SOC, that means maintaining current on-call and vendor contact trees, staged forensic and imaging kits, documented playbooks for SCADA and IT-adjacent scenarios, trained roles including an incident commander, and access to evidence storage and communication channels. Those investments prevent improvisation when pump-station or treatment-plant systems show compromise indicators. Preparation also covers mutual-aid agreements, legal and public-information contacts, and tested escalation paths so operational technology and enterprise IT responders already know how they will collaborate.

Wiping SCADA hosts at the first alert is a reactive, high-risk eradication-style action that can destroy evidence and disrupt critical process control; it is not preparation. Drafting a press release only after restoration belongs to communications during later phases, not to readiness. Waiting until malware is confirmed before naming a commander leaves leadership vacant during the most chaotic window—the opposite of prepared response. Exam questions often bait candidates with aggressive cleanup or messaging tasks when the stem asks what preparation looks like. Operationally, audit the water utility’s IR readiness quarterly: confirm contact trees still reach live people, forensic kits boot and write images, playbooks match current architecture, and tabletop results show an assigned commander within minutes of a declared incident—without inventing the org chart on the fly.