easyMultiple Choice
SSCP Developing an incident response plan Practice Question
A company is developing an incident response plan. Which of the following stakeholders should be included in the initial planning phase?
⚠ Common exam trap
A common mix-up: candidates assume incident response is purely a technical function, leading them to choose 'Only IT staff' (Option C), but the SSCP exam emphasizes that effective planning requires input from business stakeholders to ensure the plan supports organizational resilience, not just technical recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Business unit leaders
Business unit leaders (Option D) are essential in the initial planning phase because they define the critical assets, operational priorities, and recovery time objectives (RTOs) that shape the incident response strategy. Without their input, the plan may fail to align with business continuity requirements, leading to ineffective resource allocation during an actual incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
External legal counsel
Why it's wrong here
External legal counsel is engaged for breach notification, privilege and regulatory advice once an incident occurs, not for the initial scoping of detection, containment and recovery procedures. It is tempting because counsel genuinely belongs in later escalation and post-incident review, but the planning phase needs operational and technical representatives.
- ✗
Internal audit
Why it's wrong here
Internal audit reviews control effectiveness after the fact; it does not define incident response roles, escalation paths or containment actions during initial planning. It is tempting because audit validates the finished plan and tests readiness, which is a later assurance activity rather than the design phase itself.
- ✗
Only IT staff
Why it's wrong here
Restricting initial planning to IT staff omits legal, HR, communications, executive and business owners whose decisions shape escalation authority, notification duties and impact assessment. It is tempting because IT performs the technical containment work, and would be reasonable for a purely technical recovery runbook, but an incident response plan requires cross-functional input from the outset.
- ✓
Business unit leaders
Why this is correct
Business unit leaders supply operational context on critical functions, acceptable downtime and communication channels, ensuring the plan reflects real business impact. Their early involvement secures the authority and resources needed to approve response actions across departments.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.