An organization has had six security incidents over the past year against their main web
application. Each time the organization was able to determine the cause of the incident and
restore operations within a few hours to a few days. Which of the following provides the MOST
comprehensive method for reducing the time to recover?

A.
Create security metrics that provide information on response times and requirements to
determine the best place to focus time and money.

B.
Conduct a loss analysis to determine which systems to focus time and money towards
increasing security.

C.
Implement a knowledge management process accessible to the help desk and finance
departments to estimate cost and prioritize remediation.

D.
Develop an incident response team, require training for incident remediation, and provide
incident reporting and tracking metrics.