*Collect necessary information for inclusion in the communications plan (Task ID: R1-9696)

*Communicate with business management to identify additional parties that should be included in communication and response plans (Task ID: R1-9694)

*Maintain an accurate list of POCs (Task ID: R1-9698)

*The communication plan and make changes as appropriate (Task ID: R1-9700)

*Understand changes to organizations and the business to identify stakeholders to be included in the communications plan (Task ID: R1-9695)

*Verify communication plan parties and contact information with all parties at an appropriate frequency (Task ID: R1-9699)

*Test implementation with a testing regime to include events that should trigger alerts based on how the monitor has been configured. (Task ID: R1-9169)

*Test incident response system and planning remains effective against the latest attacker methodologies and tools (Task ID: R1-9591)

*Test IR specialists to verify they maintain a current understanding of threats and how to analyze (Task ID: R1-9412)

*Test remediated systems and the effectiveness of containment measures (Task ID: R1-9676)

*Test to verify that there is a correct flow of intrusion events to incident cases and that there is a coordinated response between IRS, IA, and SOS stakeholders (Task ID: R1-9592)

*Analyze actions for known malicous events and activity from spreading or providing opportunities for an attacker to move, close down command and control channels, recommend blocking outside IPs,etc. to contain the incident. (Task ID: R1-9208)

*Analyze logs and system information to determine systems impacted by an attacker and actions taken by the attacker (Task ID: R1-9666)

*Analyze technical and business impacts as a result of the incident (Task ID: R1-9677)