Incident Management and Business Continuity
What this domain tests
Incident management and business continuity tests detection, response, recovery, and resilience. Expect the incident lifecycle, severity, evidence, communications, business impact analysis, RTO and RPO, and testing.
Core rules
- An event is any observable occurrence; an incident is an event with actual or suspected harm.
- Response lifecycle: prepare, detect and analyze, contain, eradicate, recover, and lessons learned.
- Preserve evidence before rebuilding; use forensic copies and chain of custody.
- Severity drives escalation, notification, and crisis communications.
- A business impact analysis identifies critical processes and dependencies; RTO is maximum tolerable downtime; RPO is tolerable data loss.
- BCP keeps the business running; DR restores technology.
- Plans need exercises, not shelfware; test scenarios and update after changes.
Worked example
Ransomware encrypts file shares. The team isolates affected hosts, disables compromised accounts, preserves memory and disk images, and activates the crisis team. The business impact analysis says order processing can tolerate four hours of downtime and one hour of data loss. The team restores from immutable backups, validates integrity, and monitors for reinfection. After recovery, the review finds initial access was a phishing link and adds email filtering and MFA. Reasoning: containment and evidence come before recovery, and RTO and RPO guide restoration priority.
Traps
- Wiping systems before forensics.
- Having no crisis communications plan.
- Leaving the BCP untested.
- Confusing RTO with RPO.
- Treating BCP as an IT-only responsibility.