What is an incident response plan and the first actions when a security incident occurs?

• A. A documented procedure for detection, containment, eradication, recovery, and lessons learned; first actions include containment and notification.
• B. A public relations plan for media communication.
• C. A plan to upgrade software on a fixed schedule.
• D. A separate data backup plan unrelated to security events.

Answer: (A)

An incident response plan is a structured, documented approach for handling security incidents from detection through lessons learned. The best description includes the full lifecycle: detection, containment, eradication, recovery, and lessons learned. The first actions are containment to limit the incident’s impact and notification to the appropriate stakeholders, which helps minimize damage and start coordinated response. Other options miss the core incident-handling focus: a public relations plan centers on media, not the technical response; upgrading software on a fixed schedule is change management, not incident handling; a separate backup plan unrelated to security events won’t address immediate containment or recovery needs.