This objective verifies that your documented incident response process is not only written, but actively followed. It ensures that your team uses the procedures during actual incidents or exercises and that response activities are consistent with your plan.