Which statement best describes the purpose of an incident response runbook and its essential elements?

• A. Runbooks provide only general incident goals with no step-by-step actions.
• B. Runbooks document the organization's policy but not operational procedures.
• C. Runbooks provide step-by-step actions for responders during incidents and include scope, roles, contact lists, escalation paths, containment steps, eradication guidelines, evidence handling, communication plans, and recovery procedures.
• D. Runbooks are primarily training materials not used during live incidents.

Answer: (C)

An incident response runbook is an operational, action-oriented guide that tells responders exactly what to do during an incident and who is responsible for each action. It moves beyond general goals to provide a clear, repeatable plan that coordinates the team under pressure.

The essential elements include:

• Scope: what is in and out of bounds for the incident response

• Roles: who is doing what, so responsibilities are clear

• Contact lists: who to reach for internal and external support

• Escalation paths: when and to whom to escalate issues or decisions

• Containment steps: actions to limit the impact and prevent spread

• Eradication guidelines: how to remove the threat from the environment

• Evidence handling: how to collect, preserve, and document for forensics

• Communication plans: who is informed, what is communicated, and when

• Recovery procedures: steps to restore services and verify normal operations

This combination ensures responses are consistent, timely, and coordinated, minimizes confusion during high-stress incidents, supports proper evidence handling, and provides a foundation for post-incident review and improvement. Runbooks are used in live responses and are updated based on lessons learned, not merely as policy documents or training materials that aren’t applied during actual incidents.