Incident Management and Business Continuity
Incident management is the structured response to security events. An event is any observable occurrence; an incident is an event that actually or potentially harms the organisation. The lifecycle covers preparation, detection and reporting, triage and classification, containment, eradication, recovery and lessons learned. Roles must be defined, including an incident response team and communications lead. Evidence handling matters: preserve logs and forensic copies, maintain chain of custody, and know when to involve law enforcement. Reporting obligations may be legal or contractual.
Business continuity and disaster recovery
Business continuity (BC) keeps critical business functions running during disruption; disaster recovery (DR) focuses on restoring IT systems and data. Key concepts include business impact analysis (BIA), recovery time objective (RTO, the maximum acceptable downtime), recovery point objective (RPO, the maximum acceptable data loss), maximum tolerable outage, and alternate sites (hot, warm, cold). Plans must be tested through exercises and reviewed regularly.
Traps and worked example
Examiners often confuse RTO with RPO, or BC with DR. Worked example: a firm can tolerate four hours of downtime but only fifteen minutes of lost transactions; RTO is four hours and RPO is fifteen minutes. A hot site gives near-immediate recovery at high cost; a cold site is cheap but slow. Rule of thumb: RTO concerns time to restore, RPO concerns data loss, and the tighter the objective the higher the cost. Always prioritise containment to limit damage before eradication, and remember that lessons learned should feed back into risk management.