Security questionnaire answers › Incident response
Do you have an incident response plan? How to answer it in a security questionnaire
Why buyers ask this
How quickly and clearly you respond to a security incident affects customers directly.
What a strong answer includes
- State that a documented plan exists with roles, severity levels and escalation.
- Say how often it is tested (tabletop exercises).
- Include customer notification commitments and timelines.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. We maintain a documented incident response plan defining roles, severity levels, containment, investigation, communication and post-incident review. It is tested at least [annually] by tabletop exercise. We notify affected customers without undue delay and within [72 hours] of confirming a breach affecting their data.
Evidence to attach
- Incident response plan
- Latest tabletop exercise record
- Notification template
Common mistakes
- Notification promises you cannot meet.
- No test record.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.