The correct answer is A because formal incident response scenarios are essential for preparing the incident response team to recognize, coordinate, escalate, contain, and recover from realistic incident situations.
Preparedness is built through planning, exercises, role clarity, communications testing, and scenario-based practice. Without formal scenarios, the team may not be able to test whether procedures are practical, whether roles are understood, or whether communications and escalation paths work under pressure. A change in information security management may affect leadership, but it does not automatically reduce team preparedness if processes remain sound. Outdated incident response plans are a serious concern; however, the question focuses on team preparedness, and scenario-based training is a direct mechanism for preparing the team. New attack vectors are expected in a changing threat environment, but a well-prepared team with practiced response scenarios can adapt more effectively. CISM emphasizes testing, exercises, and lessons learned as key elements of incident response capability.
Reference: CISM Information Security Incident Management; incident response preparedness, scenario testing, exercises, and team readiness principles.