Which statement best describes incident response in IT security governance?

• A. It focuses only on physical security.
• B. It is primarily about planning for new product launches.
• C. It involves promptly detecting, responding to, and recovering from security incidents, including communication and coordination.
• D. It has no role in governance.

Answer: (C)

Incident response is a structured, governance-driven process for handling security incidents from detection through recovery, with clear communication and coordination among teams and stakeholders. It focuses on quickly identifying incidents, containing and eradicating threats, restoring operations, and learning from events to strengthen controls. In governance terms, it defines roles, escalation paths, and post-incident reviews to ensure accountability and continuous improvement.

This isn’t about physical security in isolation, nor is it about planning new product launches. It also isn’t something separate from governance; incident response is a core governance function that ensures preparedness, coordinated action, and transparent communication with affected parties and leadership.