Incident Response (IR) and the Incident Response Plan
Key Takeaways
Subdomain 5.3 names Incident Response (IR) and a data handling policy that implements the Incident Response Plan (IRP).
An incident response plan defines the response before an incident happens.
Respond to events through the plan, so that actions are consistent and recorded.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 5.3, checked 2026-10-22.
Incident Response and the Plan
Subdomain 5.3, Understand Incident Response (IR), names the data handling policy implementing the Incident Response Plan (IRP). The IRP is the documented response to a security incident. It is written before an incident, so that people act on agreed steps rather than improvising.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 5.3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Using the Plan in a Scenario
When a scenario describes an incident, ask whether the response follows the IRP. The correct answer usually follows the plan's documented steps and records what was done. Actions taken outside the plan, such as deleting evidence to clean up quickly, are weaker answers.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 5.3: Data handling policy implementing Incident Response Plan (IRP)
- 5.3: Incident Response (IR) exercises (e.g., testing, tabletop)
Common Traps
A common trap is responding outside the plan. The Incident Response Plan is written before the incident, so the correct answer follows its documented steps and records what was done.
Why is the Incident Response Plan written before an incident happens?
So that people respond through agreed steps rather than improvising
So the plan can be skipped during emergencies when responders are busy
So the incident does not need to be recorded in any log or report
So the data handling policy is no longer needed once the plan exists
An IRP answer should show which documented step of the plan is being followed and what the plan says to record. An answer that improvises outside the plan is weaker, even when it sounds decisive.
Sections you finish are checked off in the contents.