Which of the following is MOST important for an IS auditor to consider when reviewing the effectiveness of an incident response program?

A. Incidents are categorized according to industry standards.
B. Lessons learned are incorporated into incident response processes.
C. Incidents are escalated to senior management in a timely manner.
D. The plan is reviewed and updated annually.