which of the following would not typically be part of an incident response plan?
a. policy creation b. investigation c. containment or mitigation d. recovery