Which plan component most directly tells responders who may approve an external breach notification?

### Why this is right The roles and responsibilities section assigns decision authority and duties to responders and stakeholders. External notifications may involve legal, compliance, executive, and communications personnel, so the plan should make approval routes clear. ### The concept An incident response plan is useful only if people know who makes decisions, who performs technical work, and who communicates. The plan should also describe notification requirements and communications protocols. Legal obligations vary by incident and jurisdiction, so responders should use authoritative guidance rather than assume one universal deadline or rule. ### The other options - **B. Asset inventory**: Identifies systems and owners, but does not assign notification approval authority. - **C. Malware signature list**: Supports technical detection, not governance of external communications. - **D. Recovery backup schedule**: Helps restore systems but does not determine who can notify affected parties. ### Terms - **Breach notification**: Informing required parties about a qualifying security or privacy breach. - **Stakeholder**: A person or group affected by or involved in the incident. ### Remember Technical response and external communication need explicit, assigned decision-makers.