Describe how an organization should prepare its response team and employee communications, including how it should address responder absences.

### The concept Incident response is time-sensitive, so organizations need people with different skills and a clear way to coordinate them. Cross-functional participation can bring relevant business expertise into response. Because incidents may occur when designated responders are absent, backup responders should be named in advance. Employees also need a central point of contact for reporting suspected or known incidents, while the communications plan identifies internal and external stakeholders who may require notification. Training should match employees' roles and organizational needs. ### What a good answer covers - Describes a team with varied qualifications and cross-functional support. - Names relevant team roles and the need for backup responders. - Includes a central reporting contact and stakeholder notification procedures. - Connects employee training to business needs and individual responsibilities. ### Terms - **Central point of contact**: The designated place or person through which employees report suspected or known incidents. - **Backup responder**: A person prepared to take response duties when a designated responder is unavailable. ### Remember A response team needs both role coverage and backup coverage.