What the buyer is really asking
Do you have a written plan, do people know their roles in it, and has it been tested? Expect the buyer to ask for the document itself or a summary.
Other ways buyers ask it
Every one of these wants the same answer:
- “Do you have a documented incident response plan?”
- “How often is the incident response plan tested?”
- “Who is on your incident response team?”
- “Can you share your incident response plan?”
Evidence to have ready
- An incident response plan with roles and severity levels
- Records of a tabletop exercise or real incident review
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.