A security team wants to establish an Incident Response plan. The team has never experienced an incident. Which of the following would BEST help them establish plans and procedures?

Tabletop exercises involve simulating incident scenarios in a discussion-based format, allowing a security team to review, test, and refine their planned response steps, roles, and communication protocols without real-world impact. This method is crucial for a team with no prior incident experience as it helps identify gaps and improve procedures before an actual event occurs, thereby effectively establishing the plan.

Lessons learned are derived from post-incident reviews, but since the team has never experienced an incident, there is no historical data or experience to draw 'lessons' from for establishing initial plans.

Escalation procedures are a specific component within an incident response plan, defining who to notify and when, rather than the primary method for establishing the overall plan and its entire set of procedures from scratch.

Recovery procedures are also a specific component within an incident response plan, focusing on restoring operations, and do not represent the best overarching method for establishing the entire plan and its initial procedures.