The incident response plan is consistently followed when incidents occur
Following the response plan and logging decisions as incidents unfold turns the written plan into a practice auditors can verify was used.
Following the response plan and documenting decisions and timings as an incident unfolds is exactly the response activity this control requires.
https://sekit.ai/api/mcp/crosswalk