An incident response policy must contain:
A.
updated call trees.
B.
escalation criteria.
C.
press release templates.
D.
critical backup files inventory.
Explanation:
Escalation criteria, indicating the circumstances under which specific actions are to be undertaken, should be contained within an incident response policy. Telephone trees, press release templates and lists of critical backup files are too detailed to be included in a policy document.