CompTIA CySA+ Practice Test

Which task should be prioritized first when establishing a cybersecurity incident response plan?

1. Define the incident handling process

2. Identify critical assets and stakeholders

3. Establish communication protocols

4. Conduct a post-incident review

The correct answer is: Identify critical assets and stakeholders

Prioritizing the identification of critical assets and stakeholders is fundamental when establishing a cybersecurity incident response plan. This task ensures that the organization has a clear understanding of what needs protection and who is involved in the incident response process. By identifying critical assets, which may include sensitive data, key systems, and applications, the organization can prioritize resource allocation and response efforts effectively. Understanding stakeholders, both internal and external, is equally important because it helps in streamlining communication, ensuring that the right people are involved in decision-making during an incident. This initial step sets the foundation for a comprehensive response plan, guiding the organization to focus on what matters most when a cybersecurity incident occurs. Additionally, it allows for an informed consideration of the incident handling process, communication protocols, and the need for reviews post-incident, as these elements can be tailored based on the identified assets and involved parties.