Which term describes the process of planning and coordinating actions during an incident using pre-defined rules and priorities?

• A. Incident Response Manager
• B. Rules of Engagement
• C. Walkthrough
• D. Full Interruption Test

Answer: (B)

Planning and coordinating actions during an incident under predefined rules and priorities is described by Rules of Engagement. This framework sets who is authorized to take what actions, how escalation should occur, and how communication flows, all aligned with the incident’s priority order. It helps ensure a consistent, timely, and safe response, reducing chaos and ensuring legal and regulatory considerations are met.

Think of it as the playbook responders follow in the heat of an incident: when to isolate systems, who to notify, and which actions take precedence. This is different from naming a person who leads the response (an Incident Response Manager), a step-through review or training activity (a walkthrough), or a type of testing exercise (a full interruption test).