Response acts on the prioritised risks from Module 4, surfaced by Modules 1–3. DNS-layer blocking/sinkholing/filtering is the same control the cyber-hygiene and smart-infrastructure courses describe; its speed is measured by Module 6’s MTTR.