Incident response planning must account for organizational and business impacts, rather than focusing exclusively on technical investigation.

### Why this is right The introduction explicitly states that cybersecurity events and incidents are business problems as well as cybersecurity problems. Response planning therefore has to account for organizational effects, not only technical investigation. ### The concept A technical event can disrupt operations, affect customers, or require decisions beyond an analyst’s role. Clear definitions and procedures help staff determine which matters can remain with analysts and which should be escalated to leadership. This supports coordinated response across the organization. ### Terms - **Escalation**: Passing a matter to a higher level of authority or responsibility for action. ### Remember Incident response decisions may affect business operations, so technical teams need clear authority and escalation paths.