Incident Response and Business Continuity
This domain tests the lifecycle from detection to lessons learned, and the continuity arithmetic that tells you how much downtime and data loss the business can survive. Expect questions asking what to do first, or which metric a stated objective describes.
Incident response lifecycle (NIST SP 800-61 shape)
- Preparation - plan, roles, contact trees, playbooks, tooling, pre-approved legal and communications paths, tested backups.
- Detection and analysis - triage SIEM/EDR alerts, validate scope, classify severity, open a ticket with a timeline.
- Containment, eradication, recovery - short-term containment (isolate, block), remove the cause, patch, restore from clean backups, monitor for recurrence.
- Post-incident activity - root cause, lessons learned, control improvements, evidence retention.
Order of volatility guides evidence capture: CPU/cache and memory before disk, disk before remote logs, remote logs before archival media. Preserve chain of custody with forensic images, hashes and timestamps. Involve legal early - privilege, regulatory clocks and contractual notification duties all start running at awareness.
Continuity arithmetic
- BIA identifies critical processes, dependencies and impact over time.
- RTO - maximum tolerable downtime before resuming the service.
- RPO - maximum tolerable data loss, measured backwards from the failure; sets backup frequency.
- MTD/MAO - total downtime absorbable before unacceptable harm; RTO must be shorter than MTD.
- BCP covers the whole business; DRP covers technology recovery. Alternate sites may be hot, warm or cold.
Worked example
Ransomware encrypts a claims system at 09:00 Tuesday. The BIA gives the claims process an RTO of 8 hours and an RPO of 15 minutes. First actions: isolate affected hosts (do not power them off - memory holds keys and evidence), notify the incident commander and legal, and check whether offline or immutable backups exist and their last good timestamp. The last backup is 26 hours old, breaching the 15-minute RPO, so the team must also reconstruct Tuesday's transactions from the queue and disclose the data-loss window. Post-incident, backup frequency moves to 15 minutes and immutability is enforced.
Traps
- Shutting down a compromised machine and destroying volatile evidence.
- Swapping RTO and RPO in the answer.
- Restoring from backups before confirming they are uninfected.
- Treating a tabletop exercise as documentation rather than a tested control.