CISM · Question #183
The PRIMARY purpose of the recovery phase in incident response is to:
The correct answer is C. restore services to the point defined in the organization's business continuity plan (BCP). The recovery phase focuses on restoring affected systems and services back to normal operations, and the target state is defined by the organization's own Business Continuity Plan (BCP), which specifies recovery time objectives (RTOs) and recovery point objectives (RPOs). Root…
Question
The PRIMARY purpose of the recovery phase in incident response is to:
Options
- Aidentify and remove the root cause of an incident.
- Bidentify and document the lessons learned from an incident.
- Crestore services to the point defined in the organization's business continuity plan (BCP).
- Drestore services to the point defined in the leading industry control framework.
How the community answered
(29 responses)- A7% (2)
- C90% (26)
- D3% (1)
Explanation
The recovery phase focuses on restoring affected systems and services back to normal operations, and the target state is defined by the organization's own Business Continuity Plan (BCP), which specifies recovery time objectives (RTOs) and recovery point objectives (RPOs). Root cause identification and removal (A) occurs in the eradication phase. Lessons learned (B) belong to the post-incident review phase. Restoring to an industry control framework standard (D) is not the purpose - recovery targets are set by the organization's BCP, not external frameworks.
Topics
Community Discussion
No community discussion yet for this question.