Which item is NOT listed as part of Tier 1 risk coverage?

• A. Incident Response
• B. Governance
• C. Methodologies
• D. Risk Tolerance

Answer: (A)

The concept being tested is what Tier 1 risk coverage focuses on in this framework. Tier 1 centers on high-level, planning-oriented elements that establish how risk is governed and approached across the organization. Governance sets the leadership, roles, and policies that guide risk decisions. Methodologies provide the standardized processes for identifying, assessing, and managing risk. Risk tolerance defines the level of risk the organization is willing to accept to achieve its objectives.

Incident response, while essential, is an operational capability that deals with detecting, containing, eradicating, and recovering from security incidents. That kind of hands-on, event-focused work is typically addressed in higher tiers of risk coverage, where specific response playbooks, communications, and technical steps are defined.

Therefore, incident response is not listed as part of Tier 1 risk coverage, making it the best choice. The items that are part of Tier 1 risk coverage are governance, methodologies, and risk tolerance.