Which item is typically included in an incident timeline?

• A. Escalation points
• B. Vendor payment terms
• C. Employee benefits
• D. Marketing calendar

Answer: (A)

Incidents are tracked as a sequence of events, actions taken, and communications from detection to containment, eradication, and recovery. Escalation points are included because they mark when the incident should be handed to higher-level responders or specialized teams, ensuring timely decisions, clear accountability, and alignment with required response times or regulations. Documenting these handoffs helps keep the response moving and ensures the right experts weigh in at the right moment. The other options don’t fit because vendor payment terms, employee benefits, and the marketing calendar pertain to finance, HR, and marketing planning, not the incident response process.