Chapter 2_summary | PDF | Business
Scribd
Upload
2 views

Chapter 2_summary

Chapter 2 discusses the importance of Incident Response (IR), Business Continuity (BC), and Disaster Recovery (DR) plans in maintaining business operations during crises. It outlines the distinct roles of each plan, with IR focusing on immediate response to incidents, BC ensuring ongoing operations, and DR restoring normalcy after failures. Key components and models for each plan are detailed to emphasize their necessity for organizational survival in abnormal conditions.

Uploaded by

SayuriAlexandraHerenciaMonrroy
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
2 views

Chapter 2_summary

Chapter 2 discusses the importance of Incident Response (IR), Business Continuity (BC), and Disaster Recovery (DR) plans in maintaining business operations during crises. It outlines the distinct roles of each plan, with IR focusing on immediate response to incidents, BC ensuring ongoing operations, and DR restoring normalcy after failures. Key components and models for each plan are detailed to emphasize their necessity for organizational survival in abnormal conditions.

Uploaded by

SayuriAlexandraHerenciaMonrroy
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 4

Chapter 2

Incident Response (IR),

Business Continuity (BC)

and Disaster Recovery (DR)

Domain Summary
This domain focused mainly on the availability part of the CIA triad and the importance of

maintaining availability for business operations. Maintaining business operations during or


after an incident, event, breach, intrusion, exploit or zero day is accomplished through the

implementation of Incident Response (IR), Business Continuity (BC), and/or Disaster


Recovery (DR) plans. While these three plans may seem to overlap in scope, they are three

distinct plans that are vital to the survival of any organization facing out of the ordinary

operating conditions. Here are the primary things to remember from this domain:

First, the Incident Response plan responds to abnormal operating conditions to keep the
business operating. The four main components of Incident Response are: Preparation;
Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity.
Incident Response teams are typically a cross-functional group of individuals who represent the
management, technical and functional areas of responsibility most directly impacted by a
security incident. The team is trained on incident response and the organization’s incident
response plan. When an incident occurs, the team is responsible for determining the amount
and scope of damage and whether any confidential information was compromised,
implementing recovery procedures to restore security and recover from incident-related
damage, and supervising implementation of future measures to improve
security and prevent recurrence of the incident.

Second, the Business Continuity plan is designed to keep the organization operating through

the crisis. Components of the Business Continuity plan include details about how and when

to enact the plan and notification systems and call trees for alerting the team members and
organizational associates that the plan has been enacted. In addition, it includes contact
numbers for contacting critical third-party partners, external emergency providers, vendors

and customers. The plan provides the team with immediate response procedures and

checklists and guidance for management.

Finally, if both the Incident Response and Business Continuity plans fail, the Disaster
Recovery plan is activated to return operations to normal as quickly as possible. The Disaster
Recovery plan may include the following components: executive summary providing a high-
level overview of the plan, department-specific plans, technical guides for IT personnel
responsible for implementing and maintaining critical backup systems, full copies of the plan
for critical disaster recovery team members, and checklists for certain individuals.

Module 1: Understand Incident Response (IR


Incident Response Terminology:

• Breach
• Event

• Exploit

• Incident
• Intrusion

• Threat

• Vulnerability
• Zero Day

Four Main Components of Incident Response are:

• Preparation

• Detection and Analysis

• Containment, Eradication and Recovery


• Post-Incident Activity

Three Possible Models for an Incident Response Team (IRT):

• Leveraged
• Dedicated

• Hybrid

Module 2: Understand Business Continuity (BC)


Components of a Business Continuity (BC) Plan include:

• List of the BCP team members, including multiple contact methods and backup

members

• Immediate response procedures and checklists (security and safety procedures, fire

suppression procedures, notification of appropriate emergency-response agencies,


etc.)
• Notification systems and call trees for alerting personnel that the BCP is being enacted

• Guidance for management, including designation of authority for specific managers

• How/when to enact the plan

• Contact numbers for critical members of the supply chain (vendors, customers,

possible external emergency providers, third-party partners)


• How/when to enact the plan

• Contact numbers for critical members of the supply chain (vendors, customers,

possible external emergency providers, third-party partners)

Module 3: Understand Disaster Recovery (DR)


Five Possible Components to Include in a Disaster Recovery (DR) Plan:

1. Executive summary providing a high-level overview of the plan

2. Department-specific plans

3. Technical guides for IT personnel responsible for implementing and maintaining critical

backup systems

4. Full copies of the plan for critical disaster recovery team members

5. Checklists for certain individuals

You might also like