How often must the incident response plan be tested?

• A. Never test the plan
• B. Test every quarter
• C. Test the plan at least annually
• D. Test only after a breach

Answer: (C)

Regular testing of the incident response plan keeps the team prepared, confirms that roles and escalation paths work, and validates that containment, eradication, and communication steps are effective in practice. The minimum requirement is to test at least once a year, and to re-test after significant changes such as new systems, processes, or personnel. This cadence helps catch gaps before an incident occurs and ensures the plan stays current. Waiting until after a breach would miss chances to prevent or limit damage, and never testing leaves unresolved weaknesses; testing more often (for example, quarterly) might be helpful, but the standard specifies at least annually.