Which items are explicitly required to be included in an incident response plan?

• A. A diagram of the network topology
• B. Roles, responsibilities, communication strategies; specific incident response procedures; business recovery and continuity; data backup; legal reporting requirements; coverage of all critical components; reference to payment brand procedures
• C. Training of staff only
• D. Budget approval processes

Answer: (B)

The main idea tested here is that an incident response plan must be comprehensive and clearly address who does what, how to communicate, the exact steps to take during an incident, and how to recover and report. This option is the best because it lists the essential elements that PCI DSS requires: defining roles and responsibilities and how to communicate during an incident; concrete incident response procedures; plans for business recovery and continuity; data backup and restoration considerations; legal reporting requirements; ensuring coverage of all critical components; and references to payment-brand procedures. These pieces together ensure the organization can detect, respond to, and recover from incidents in a controlled, compliant way. The other choices miss key components: a network topology diagram isn’t explicitly required to be part of the incident response plan; training alone doesn’t constitute a full plan; and budget approval processes are not a mandated part of the plan’s content.