Problem
No matter how an organization breaks up the incident response management process, the incident report team must have clear roles and a clear plan of action.
What do you think the most realistic method of testing the plan should be? Should all of these people be involved?