The security officer is preparing a read-only USB stick with a document of important personal
phone numbers, vendor contacts, an MD5 program, and other tools to provide to employees. At
which of the following points in an incident should the officer instruct employees to use this
information?

A.
Business Impact Analysis

B.
First Responder

C.
Damage and Loss Control

D.
Contingency Planning

Explanation:
Incident response procedures involves: Preparation; Incident identification; Escalation and
notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First
responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss
control. In this scenario the security officer is carrying out an incident response measure that will
address and be of benefit to those in the vanguard, i.e. the employees and they are the first
responders.