Arrange the incident response planning activities in the correct chronological sequence, from initial assessment to operational procedures.

### The order 1. **Identify valuable information and systems**: The organization first determines what it needs to protect. 2. **Assess likely incident types and risks**: Once assets are understood, the organization can consider threats, likelihood, and impact. 3. **Establish policy, roles, and responsibilities**: Governance defines authority and assigns response duties. 4. **Set communication and notification procedures**: The plan then specifies how responders and stakeholders will communicate. ### The concept These activities are related planning decisions, not a rigid universal workflow. The sequence reflects the logic in the material: understand organizational value and possible incidents, use that understanding to shape response governance, then specify how information will move during response. Communication arrangements should identify a central employee reporting point and the internal or external stakeholders who may need notification. ### Terms - **Stakeholder**: A person or organization with an interest in, or affected by, the incident or response. - **Notification procedure**: A planned method for deciding who is informed and how. ### Remember Understand what is at risk before assigning response authority and communication duties.