ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Best practice guidance such as NIST SP 800-61 recommends naming a single individual who can officially declare an incident and mobilize the incident response team. This position is commonly called the Incident Response Manager or Incident Commander. While Tier-1 SOC analysts or forensic specialists contribute important information, they normally lack the organizational authority to change the incident's status. Likewise, the AWS Support account owner represents an external escalation path rather than an internal command role. Clearly designating the Incident Response Manager ensures decisions are made quickly and consistently during a crisis.