Which of the following should be updated FIRST when aligning the incident response plan with the corporate strategy?

Security procedures detail the 'how-to' of incident response; they should be updated after the strategic risk response scenarios are defined.

The Disaster Recovery Plan (DRP) addresses broader recovery from major disruptions and is a separate, though related, plan that relies on the foundational risk appetite defined by corporate strategy.

The incident notification plan specifies who gets informed and when, which is a procedural element determined by the nature of the incident and its strategic impact as defined by risk response scenarios.

When aligning an incident response plan with corporate strategy, updating risk response scenarios should be the first step because the corporate strategy dictates the organization's overall risk appetite and how it prioritizes responses to various threats. These scenarios directly reflect the business's tolerance for different types of incidents and guide the specific actions and priorities within the incident response framework, ensuring alignment with overarching business objectives.