Which of the following is a primary outcome of an effective Incident Handling program?

Question

Options

• AReduced time between system outage and service restoration or alternate resources brought
• BCritical systems are identified and assigned a business owner.
• CReduced time between detecting an adverse system event and when the root cause is
• DCritical systems are backed up and restores are tested regularly.

• A
  86% (25)
• B
  7% (2)
• C
  3% (1)
• D
  3% (1)

Explanation

The ultimate business goal of an Incident Handling program is to minimize the impact of adverse events on the organization - and the most direct measure of that is how quickly normal operations are restored after an outage. Reducing the time from outage to service restoration (or failover to alternate resources) is the primary operational outcome, directly tied to the Recovery phase of incident response lifecycles (e.g., SANS PICERL: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned). Options B and D describe asset management and backup/recovery practices that support business continuity planning, not incident handling specifically. Option C (reducing time to root cause) describes the Analysis/Eradication phases and is an important subprocess, but it is a means to the end - the primary measurable outcome for the business remains how fast services are restored.

No community discussion yet for this question.