What escalation criteria and timelines should be included for cyber incidents in audit findings?

• A. Severity-based criteria, timelines for notifying management/board, defined escalation paths, and deadlines for remediation progress updates.
• B. A general instruction to report incidents promptly without specifics.
• C. Only the time to notify executives, with no escalation paths.
• D. No timelines or escalation criteria required.

Answer: (B)