CompTIA Security+ SY0-701 Practice Question

Developing and documenting an incident response policy is the MOST critical activity for establishing an incident response capability. This policy outlines the purpose, scope, roles, responsibilities, and management commitment. It serves as the foundation for the entire incident response process. Distributing an employee handbook only communicates existing policies and procedures, conducting background checks is an HR security measure, and holding a retrospective meeting is an activity that takes place after an incident has been handled (part of the 'Lessons Learned' phase).