What it asks for. The organisation must provide an incident response support resource, part of the incident response capability, that offers advice and assistance to users on handling and reporting incidents.
In practice. This is a help desk path, security team contact or service portal where staff can get guidance quickly when they suspect an incident. Many organisations also hold a retainer with an external incident response provider for major events. Auditors look for published contact routes, service hours and retainer agreements. Self-service guidance on the intranet helps staff take sensible first steps while waiting for responders.
Common gaps. Staff may not know where to turn outside business hours. External retainers are sometimes signed but never tested, so onboarding the provider during a crisis is slow. Support staff may also lack clear criteria for escalating to the security team.