A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)
- Introduce a priority rating for incident response workloads.
- Provide phishing awareness training for the fill security team.
- Conduct a risk audit of the incident response workflow.
- Create an executive team delegation plan.
- Automate security alert timeframes with escalation triggers.