The security officer is preparing a read-only USB stick with a document of important personal phone numbers,
vendor contacts, an MD5 program, and other tools to provide to employees. At which of the following points in
an incident should the officer instruct employees to use this information?

A.
Business Impact Analysis

B.
First Responder

C.
Damage and Loss Control

D.
Contingency Planning

Explanation:
Incident response procedures involve: Preparation; Incident identification; Escalation and notification; Mitigation
steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation
(Quarantine; Device removal); Data breach; Damage and loss control. In this scenario the security officer is
carrying out an incident response measure that will address and be of benefit to those in the vanguard, i.e. the
employees and they are the first responders.