A methodology to achieve the desired outcomes as defined in the policy. This is often presented as forms or as lists of steps to be taken prior to or during an incident.