What is the role of an incident response plan in cybersecurity governance?

• A. To audit user access logs quarterly
• B. To implement data backups
• C. To detect, respond to, and recover from security incidents, with defined roles, communication, and coordination
• D. To design new firewall rules

Answer: (C)

An incident response plan in cybersecurity governance acts as a structured playbook for handling security events. It defines how incidents are detected, how the organization responds, and how systems are restored, with clear roles, responsibilities, and lines of communication. This ensures coordinated, timely actions across teams (IT, security, legal, communications, management) and provides a disciplined process for containment, eradication, recovery, and post-incident review. Through this governance framework, the organization can minimize damage, maintain accountability, and continuously improve based on lessons learned. The described approach—detecting, responding to, and recovering from incidents with defined roles, communication, and coordination—best captures the purpose. Auditing user access logs, performing backups, or designing firewall rules are important activities but belong to separate aspects of governance (monitoring/compliance, recovery planning, and defensive engineering), not the incident response plan’s core role.