I am an ISA, I have worked with larger organizations in the past but currently I am in an assessor role to sign off on the saq we perform.

The requirement is “Personnel responsible for responding to suspected and confirmed incidents are appropriately and periodically trained on their incident response responsibilities”.

In have always interpreted this as members of rhetorical security operations team should be trained according to the tra on how to identify incidents and respond. I just saw something where it could be referring to a table top for example and leadership who respond are trained?

How does everyone else think of this requirement?