Which activity focuses on preparedness for quick response to security incidents?

• A. Incident Response Planning
• B. IAM Lifecycle Phases
• C. Access Enforcement
• D. Data Encryption

Answer: (A)

Incident response planning is about being prepared to react quickly when security incidents occur. It sets up everything you need before an incident shows up: clearly defined roles and responsibilities, escalation paths, and pre-approved communication templates so the right people are alerted at the right time. It also develops runbooks or playbooks that outline step-by-step actions for detection, containment, eradication, and recovery, plus schedules for practice exercises so the team can execute smoothly under pressure. This level of preparedness directly supports a fast, coordinated response, reducing impact and helping restore normal operations sooner.

The other options focus on different aspects. IAM lifecycle phases deal with provisioning and managing user identities and access over time, not with how to respond quickly to incidents. Access enforcement is about enforcing who can do what, which is a preventive control, not the readiness and response coordination needed during an incident. Data encryption protects data even if a breach occurs, but it doesn’t address how to detect, respond, and recover from incidents.