Incident Response, Resilience, and Business Continuity Policy
The lifecycle
Incident response follows a cycle: prepare, detect and analyze, contain, eradicate, recover, and learn. Know the difference between an event, an incident, and a breach (a confirmed exposure of protected data). A frequent trap is choosing "eradicate" when the scenario calls for immediate containment - stop the spread first, then clean.
Distinguish business continuity (BC) - keeping critical functions running during disruption - from disaster recovery (DR) - restoring IT systems and data. Key metrics: RTO (maximum tolerable downtime), RPO (maximum tolerable data loss), and MTD (maximum tolerable downtime before unacceptable harm). RTO must be ≤ MTD; RPO drives backup frequency. A classic exam error is confusing RTO and RPO.
Understand resilience as the ability to absorb, adapt, and recover, supported by redundancy, segmentation, tested backups (including immutable/offline copies), and alternate processing sites. Tabletop exercises test decisions and communications; functional tests validate restoration. Lessons-learned reviews should feed corrective actions with owners and deadlines.
Communications are policy-controlled: who speaks to regulators, customers, media, and law enforcement, and under what authority. Legal privilege and law-enforcement engagement decisions belong to counsel and executives, not the technical team.
Rule of thumb: Contain before you eradicate; recover to a known-good state; and never promise an RTO you have not tested.