Under standard incident management frameworks such as the NIST Cybersecurity Framework, which capability falls under the Respond function? Select all that apply.

### Why this is right - **A response team with the skills to manage incidents** is correct because the strategy calls for a capable incident response team. - **Coordination processes for internal and external stakeholders** is correct because response must coordinate activity and communication. - **Forensic investigation capabilities** is correct because the strategy calls for timely investigation with the required information. ### The concept Respond is about being prepared to manage an incident, not claiming that incidents can be eliminated. Its capabilities include people, procedures, coordination, and technical expertise. External forensic specialists may be needed when the organisation lacks all required skills in-house. ### The other options - **D. A guarantee that incidents will never happen**: the document says complete prevention is impossible, so response capability is needed precisely because incidents may occur. ### Terms - **Forensic investigation**: systematic examination of evidence to understand what happened during an incident. - **Stakeholder**: a person or organisation affected by, involved in, or interested in an activity. ### Remember A response plan prepares the organisation to manage incidents; it does not promise they will never occur.