The most important component of effective security incident response is a documented communications plan. A communications plan defines the roles and responsibilities, channels and methods, frequency and timing, and content and format of the communications that take place during and after a security incident. A communications plan helps to ensure that the relevant stakeholders are informed and updated about the incident status and outcome, and that the incident response activities are coordinated and consistent. A communications plan also helps to manage the expectations and perceptions of the stakeholders, and to maintain the trust and reputation of the enterprise. Network time protocol synchronization, identification of attack sources, and early detection of breaches are also important components of effective security incident response, but they are not as important as a documented communications plan. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1.2, page 1931

1: ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide, Answer to Question 660.