An incident response policy should establish authority, roles, and responsibilities, and should be approved by senior management and executives.

### Why this is right The policy gives the response process organizational authority by stating who can act and what responsibilities people hold. The material calls for approval by senior management and executives. ### The concept A **policy** sets organizational direction and authority. Incident response procedures and processes put that direction into practice. The policy should align with the organization's policy and compliance requirements, so responders do not act outside their assigned authority or ignore obligations. Approval by senior leaders makes the responsibilities and authority an organizational commitment rather than an informal team preference. ### The other options - **False**: This would incorrectly remove senior approval and leave authority, roles, or responsibilities less clearly established. ### Terms - **Incident response policy**: An approved organizational statement establishing authority, roles, and responsibilities for incident response. - **Compliance requirements**: Rules or obligations the organization must follow. ### Remember The policy establishes who is authorized to do what; procedures describe how response work is carried out.