What is the first step in planning the response to information security incidents?

Comprehensive and Detailed Explanation From Exact Extract:

In ISO/IEC 27035-2:2016, the planning phase of incident response starts with establishing a classification system. Response classification is essential to ensure that incidents are assessed and categorized in a consistent manner, allowing appropriate response measures to be applied. This classification forms the foundation for selecting the right procedures, team involvement, and communication protocols.

Assigning a response class (Option A) is a subsequent step that occurs once an incident is analyzed and matched to a pre-defined category. Developing response processes (Option B) is important but comes after the classification model is defined.

Reference Extracts:

ISO/IEC 27035-2:2016, Clause 6.3.2: “The response planning process begins with the classification of potential incidents to determine the required actions and responsibilities.”

Clause 7.2.2: “Defining response classes helps the organization decide how to handle specific categories of incidents.”

Correct answer: C

—