Why does a cyber strategy include a Respond section even when the organisation has strong preventive controls?

### Why this is right The material explicitly recognises that it is impossible to prevent every cyber incident. Response planning prepares the organisation to limit impact and coordinate action if an event occurs. ### The concept Prevention reduces the chance or effect of an incident, but it cannot guarantee that no incident will happen. Response covers immediate action, coordination, communications, analysis, mitigation, and learning. Recovery then restores systems and operations. Treating response as unnecessary would leave the organisation unprepared for events that bypass controls or exploit an unexpected weakness. ### The other options - **B. Because response planning makes prevention unnecessary**: response and prevention serve different purposes and should both be considered. - **C. Because only large organisations experience incidents**: the source does not make this claim; Care Ltd is a relatively small example organisation. - **D. Because recovery is always automatic after an attack**: the strategy calls for tested plans, which would be unnecessary if recovery were automatic. ### Terms - **Mitigation**: actions that reduce the impact or spread of a problem. ### Remember Assume prevention can fail and prepare an organised response.