Define an incident response runbook and a playbook; how do they differ?

• A. A runbook provides step-by-step procedures for incident handling; a playbook includes policy and decision points for escalation and coordination.
• B. A runbook includes policy decisions; a playbook lists step-by-step procedures.
• C. They are interchangeable terms with identical content.
• D. A runbook is for security incidents only; a playbook is for power outages only.

Answer: (A)

The main distinction is that a runbook is about the hands-on, step-by-step actions responders take to handle an incident, while a playbook covers the policy, decisions, and coordination needed to manage the incident across teams and stakeholders. A runbook lays out concrete steps, checklists, commands, and sequences you follow to detect, contain, eradicate, and recover from the issue. A playbook defines escalation criteria, who to contact, roles and responsibilities, and how information is communicated and coordinated during the incident.

This difference is why the best wording says the runbook provides step-by-step procedures for incident handling, and the playbook includes policy and decision points for escalation and coordination. The other descriptions mix up roles (treating policy decisions as runbook content or steps as policy), claim they’re interchangeable, or limit usage to a single incident type, which doesn’t align with how these documents are used in practice.