Which of the following are examples of some of the responsibility of a corporate CSIRT and the policies it helps create? (Choose four)

Scanning a vendor's customer network is outside the CSIRT's authority and scope - CSIRTs operate within their own organization's boundaries and lack authorization to probe third-party networks.

Incident classification and handling is a primary CSIRT responsibility, involving categorizing severity, coordinating response, and managing the full lifecycle of security incidents.

Information classification and protection is a CSIRT-supported policy area, ensuring sensitive data is labeled and safeguarded appropriately during and after incidents.

Information dissemination involves communicating threat intelligence and incident details to appropriate internal and external stakeholders, a key CSIRT coordination duty.

Record retention and destruction policies fall under CSIRT governance, ensuring that evidence and logs are preserved or securely destroyed per legal and regulatory requirements.