During an internal audit, it was discovered that an organization lacked a formal process for employees to report security vulnerabilities. To rectify this, the auditor recommended the creation of a new document. Which document should specifically outline the procedures for reporting security weaknesses?
Change Management Policy
Business Continuity Policy
Incident Response Policy
Disaster Recovery Policy