—
Comprehensive and Detailed Explanation From Exact Extract:
According to ISO/IEC 27035-1:2016 and ISO/IEC 27035-2:2016, business managers have a vital governance and operational oversight role in relation to information security incident response. Their main function is to ensure that incident management activities align with the organization’s business processes and risk management strategies.
Clause 7.2.1 of ISO/IEC 27035-2 highlights that business managers are responsible for ensuring that the incident response teams (IRTs) understand business priorities, and that response activities reflect the criticality of affected systems and services. Business managers also help define the operational boundaries and authority of IMTs and IRTs when incidents impact key business systems. Their involvement ensures that decisions made during response efforts support overall organizational resilience and legal compliance.
Option A is more aligned with human resources or legal/compliance functions, not core business manager responsibilities. Option B relates more closely to legal counsel or data privacy officers who are tasked with interpreting laws and regulations concerning breach notifications and liability.
Reference Extracts:
ISO/IEC 27035-2:2016, Clause 7.2.1: “Business managers are responsible for ensuring the coordination between business requirements and incident response activities, and for defining authority over the systems under their management.”
Clause 6.1.1: “Incident response activities must be aligned with business continuity plans and critical asset protection priorities.”
Therefore, the correct and most comprehensive answer is: C – Understanding how the IMT and IRTs support business processes and define authority over business systems.
—
