What Should an Analyst Do When IR Playbooks Reference Decommissioned Assets?

Why the Answer Is Correct

Playbooks are only as accurate as the asset and contact data behind them, and the preparation phase of the incident management life cycle explicitly requires maintaining an up-to-date inventory of assets, roles, and escalation paths that response steps reference. When a playbook points at a decommissioned server, account, or tool, the discrepancy proves the inventory and the documentation have drifted apart, so the corrective action is to reconcile the inventory first — which is exactly option C, starting an asset inventory review with the team that owns those assets. Once the review confirms what still exists, every affected playbook can be corrected against verified data instead of guesswork. This is also the cheapest and most auditable path: it produces a definitive record of decommissioned versus active resources that can be reused across all playbooks rather than patched playbook by playbook. rocco82 states the reasoning plainly: decommissioned resources make the instructions unusable, so "You need to do an asset inventory and correct the playbooks."

Why the Other Options Are Wrong

Option A (schedule a meeting for a policy review) addresses governance paperwork, but no policy is broken here — the defect is stale operational data, and a policy review would produce no corrected asset list. Option B (create an automation script to archive unused playbooks) automates the wrong action entirely; the playbooks are still needed, they simply reference resources that no longer exist, and archiving them would remove valid response procedures. Option D (rewrite all threat response playbooks) is the strongest distractor because it looks proactive, but a blanket rewrite performed before the inventory is corrected will re-embed the same decommissioned references, waste effort, and potentially introduce new errors into procedures that were otherwise sound. Notice that all three wrong options act on the document, while only C acts on the underlying truth the document depends on.

Community Comment Notes

Community voting on this item converges on C, with the reasoning tracking the same root-cause logic used above: stale references mean the playbook's instructions no longer work, so the asset record must be fixed first. The phrasing used by rocco82 — that decommissioned resources break the playbook's instructions — is worth remembering as a one-line heuristic for this question family. Treat the lone supporting vote as confirmation rather than proof; the decisive justification is the preparation-phase requirement in NIST SP 800-61 to maintain current asset and contact information used by response procedures.

On exam day, when a scenario describes documentation that no longer matches reality, ask which option corrects the source data rather than the document surface — that usually eliminates two or three answers instantly.