Business Continuity and Incident Response Risk
Domain 9 tests recovery planning and incident response as risk treatments, with emphasis on business impact analysis and testing.
Core rules
- A BIA identifies critical processes, dependencies, and maximum tolerable downtime (MTD).
- RTO is the target time to restore a process; RPO is the acceptable data loss measured in time; MTD is the limit before unacceptable harm.
- Recovery strategies such as hot site, warm site, replication, and manual workaround must be justified against RTO, RPO, and cost.
- Incident response follows prepare, detect, contain, eradicate, recover, and lessons learned; crisis communication is part of the plan.
- Test exercises such as tabletop, simulation, and failover validate assumptions and must produce tracked corrective actions.
Worked example
A BIA shows order processing has an MTD of 8 hours, an RTO of 4 hours, and an RPO of 15 minutes. A warm site meets neither RTO nor RPO; a hot site with database replication meets both at $500,000 per year. The team compares that cost with the estimated $2 million loss from an 8-hour outage and selects the hot site, then schedules a failover test. The reasoning ties recovery architecture to BIA-derived targets and validates the choice with a test.
Traps
- Confusing RTO with RPO or MTD.
- Building a plan without a BIA.
- Testing recovery but not incident decision-making and communication.
- Assuming backups alone satisfy continuity requirements.