Certified Chief Information Security Officer (CCISO) — Question 139

Your incident response plan should include which of the following?

Answer options

• A. Procedures for classification
• B. Procedures for charge-back
• C. Procedures for reclamation
• D. Procedures for litigation

Correct answer: C

Explanation

The correct answer is C, as procedures for reclamation are essential for recovering lost data or resources after an incident. Options A and D, while relevant to overall management and legal considerations, do not directly pertain to the recovery process that reclamation focuses on. Option B, charge-back procedures, are related to billing and financial accountability rather than incident response.