In incident response planning, which element defines the step-by-step actions to be taken during an incident?

• A. Governance
• B. Procedures
• C. Policies
• D. Tools/Resources

Answer: (B)

The idea being tested is how incident response plans translate strategy into actionable steps. During an incident, you need a precise, repeatable sequence of actions to detect, contain, eradicate, recover, and communicate. That sequence is defined by procedures—documented runbooks that specify what to do, in what order, who does it, and which tools to use. They provide the concrete steps responders follow so responses are consistent and evidence is preserved. Governance sets who has authority and oversight but not the exact actions; policies give high-level rules and expectations but not the detailed steps; tools and resources are the assets used to perform work, not the prescribed sequence itself. For example, procedures might lay out the exact triage process, how to isolate affected systems, how to collect and preserve logs for forensics, who to notify, and how to escalate.