A Chief Information Security Officer is developing procedures to guide detective and corrective activities associated...

An Incident Response Plan (IRP) is the most relevant document because the scenario is about detective and corrective activities after or during security events. Phishing, social engineering, and business email compromise are incident categories that require predefined escalation paths, containment actions, communication steps, evidence handling, and recovery procedures. SDLC focuses on secure software development, not operational response. BCP focuses on maintaining business operations during disruption, and AUP defines acceptable user behavior. The IRP tells security teams how to detect, analyze, contain, eradicate, and recover from incidents. For Security+, this aligns directly with incident response preparation and operational procedures for common attack types.