Which two things does an incident response policy define, according to NIST? Choose two.

Answer: C. Definitions of events, cybersecurity incidents, investigations and related terms
A. Which roles hold authority to confiscate, disconnect or shut down technology assets

SP 800-61r3 states most incident response policies include definitions of events, incidents, investigations and related terms, and roles, responsibilities and authorities such as which roles may confiscate, disconnect or shut down assets.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.3 Incident Response Policies