An organization has a policy to respond “ASAP” to security incidents. The security team is having a difficult time prioritizing events because they are responding to all of them, in order of receipt.
Which part of the IRP does the team need to implement or update?
A . Scheduling of incident responses
B . ‘Post mortem’ documentation
C . Classification of incidents
D . Containment of incidents
Answer: C