I85PREP
⌘ K
EXIN Information Security Essentials study materials
EXIN Information Security Essentials study resources

EXIN Information Security Essentials: Incident Management and Business Continuity

EXIN Information Security Essentials · Work through your exam, one topic at a time.

All guide sections

Incident Management and Business Continuity

This domain separates handling an incident from keeping the business running, and tests the key time metrics. Questions frequently give a set of recovery requirements and ask whether the stated backup or site design satisfies them.

Incident management (ISO/IEC 27035)

  • An event is any observable occurrence; an incident is one or more unwanted events with a significant probability of compromising business operations and threatening security.
  • Phases: prepare, detect and report, assess and classify, respond and contain, eradicate, recover, evaluate and learn.
  • Roles: incident manager, response team, communications, legal, and management escalation routes.
  • Evidence: preserve logs, image disks, maintain chain of custody; do not wipe or blindly power off before investigation.
  • Legal reporting: under GDPR, notify the supervisory authority within 72 hours of becoming aware where there is a risk to rights and freedoms.

Business continuity (ISO 22301)

  • A business impact analysis identifies critical processes and dependencies and derives the maximum tolerable downtime.
  • RTO is the target time to restore the service; RPO is the acceptable data loss measured backwards in time from the incident.
  • Recovery options: hot site, warm site, cold site, reciprocal arrangement, cloud failover; backups following the 3-2-1 rule with tested restores.
  • DRP covers IT recovery, BCP covers the whole business, crisis management covers command and communication.
  • Test types: tabletop walkthrough, simulation, parallel test, full failover - at least annually, with findings tracked.

Worked example

An order system needs an RTO of 4 hours and an RPO of 15 minutes. Nightly backups give an RPO of up to 24 hours, so they fail the requirement. The answer is continuous replication or 15-minute log shipping, plus a warm site able to fail over inside 4 hours. If the business genuinely tolerates 24 hours of loss, then the documented RPO is wrong and must be corrected - not the technology.

Traps that cost marks

  • Swapping RTO and RPO in the answer.
  • Treating BCP and disaster recovery as identical.
  • Stopping the process at containment with no lessons-learned step.
  • Plans that are written but never tested, or tested without senior management.