A security team wants to establish an Incident Response plan. The team has never experienced an incident.

Which of the following would BEST

help them establish plans and procedures?

A. Table top exercises

B. Lessons learned

C. Escalation procedures

D. Recovery procedures