Assigning who does what during an incident is the purpose of an incident response plan. This document clearly lays out the incident response team’s structure, who has authority to make decisions, who leads the response, who handles technical analysis, who communicates with stakeholders, and how escalation should occur. It also specifies contact lists, the sequence of actions at each stage (detection, containment, eradication, recovery, and lessons learned), and the overall workflow to keep the response organized and efficient. Other documents serve different purposes. An Acceptable Use Policy defines what users may and may not do with IT resources. A Data Handling Procedure explains how data should be classified and protected. A Continuity Plan focuses on keeping critical business functions running or restoring them after a disruption, rather than detailing the incident response roles and day-to-day actions during a security incident.