What training must personnel receive regarding incident response?

• A.Only read the IR plan, because personnel need training on the incident response plan only when it changes for tokenized data stores while the remediation plan remains open
• B.No IR training needed, since twenty-four seven availability of incident response staff was withdrawn in v4.0 for SAQ D merchants after the March 2025 future-dated deadline
• C.Personnel with incident response responsibilities must be trained on the IR plan, including their specific roles, escalation procedures, and evidence handling requirements
• D.Only annual security awareness, which v4.0 supports by making the acquiring bank the first responder for merchant breaches, with the merchant's own duties beginning only after the acquirer's investigation closes