Incident Response, Business Continuity & Disaster Recovery

Summary

One ransomware scenario — a small practice opening Monday to find its patient records encrypted — runs through the whole lesson, because three different plans answer it and mixing them up is where candidates stumble. The cyber incident response plan establishes procedures to address cyber attacks: identify, mitigate, and recover from malicious incidents. The business continuity plan sustains the organization's mission and business processes during and after the disruption, whether or not the computers are back. The disaster recovery plan is the information system-focused plan for major disruptions that deny access to the primary facility, designed to restore operability of the target systems at an alternate site. One line keeps them straight: incident response is about the attack; continuity is about the mission; disaster recovery is about restoring the systems. On the current ISC2 CC outline (effective September 2026), business continuity and disaster recovery sit in Domain 2 §2.2 (redundancy), and incident response sits in Domain 5 §5.3 — older material grouped all three together, and that grouping is gone.

The lesson then covers the incident response model as NIST frames it today: SP 800-61 Rev. 3 (April 2025) builds response on the six NIST Cybersecurity Framework 2.0 functions — Govern, Identify, and Protect on the preparation side; Detect, Respond, and Recover on the incident response side; improvement running continuously through the middle. The older four-phase model (Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity) comes from SP 800-61 Rev. 2, withdrawn April 3, 2025, and is labeled in the lesson as the previous model — it is NIST's old model, not an ISC2 list; the CC outline names no phases. Recovery stands on backups, so the lesson defines the three types per NIST SP 800-34 Rev. 1: a full backup captures all files selected; an incremental captures files created or changed since the last backup of any type; a differential stores files created or modified since the last full backup. Then the two objectives the exam loves to swap: the recovery time objective (RTO) is about the clock — the maximum time a system resource can remain unavailable before unacceptable impact — and it normally sits inside the wider maximum tolerable downtime (MTD); the recovery point objective (RPO) is about data — the point in time, prior to a disruption, to which data can be recovered, in plain terms how much data loss the process can tolerate. Those numbers come from the business impact analysis (BIA): correlate each system with the critical processes it supports, in three steps — determine the business processes and their recovery criticality; identify the resource requirements; identify recovery priorities. Priorities also decide where systems recover: a cold site has space and infrastructure but no computer equipment in place; a warm site is partially equipped with some or all hardware, software, telecommunications, and power; a hot site is configured with the necessary hardware, supporting infrastructure, and support personnel. Finally, the tabletop exercise: a discussion-based exercise where personnel discuss their roles and responses to a scenario a facilitator presents — discussion only, no equipment deployed — and the CC outline names tabletop exercises directly as an incident response exercise example. The lesson closes with two original practice questions, written for this lesson; they are not exam questions.

Chapters

• 0:00 Hook + where these topics live on the current outline (re-mapping)
• 0:50 The three plans — one ransomware scenario (IR plan / BCP / DRP)
• 2:11 The incident response life cycle — NIST Rev. 3 today, Rev. 2 previous model
• 4:12 Backups — full, incremental, differential
• 5:20 RTO vs RPO — clock versus data (and MTD)
• 6:13 Business impact analysis, critical functions & alternate sites
• 7:27 Tabletop exercises
• 8:08 Practice questions — AQ1 (RPO vs RTO) and AQ2 (which plan restores the systems)
• 10:20 Your two numbers (participation prompt) + end-card

The two practice questions, with answers and sources

1. Question 1 — RPO vs RTO. A mail server fails at 3:00 p.m. The most recent usable backup is from 11:00 a.m. Management has decided the business can tolerate losing up to four hours of messages, and separately that the server must be back in service within eight hours of an outage. The four-hour data-loss tolerance is the: A — Recovery Time Objective. B — Recovery Point Objective. C — Maximum Tolerable Downtime. D — Business Impact Analysis. Answer: B — Recovery Point Objective. The RPO is the point in time, prior to a disruption, to which data can be recovered, and NIST describes it as the factor for how much data loss the process can tolerate — here, four hours (the 3:00 p.m. failure against the 11:00 a.m. backup is exactly that four-hour exposure). The eight-hour "back in service" figure is the RTO side: it measures restoration time, not data loss. The maximum tolerable downtime is the total tolerable outage, a different defined term, and a business impact analysis is an analysis, not an objective. Source: NIST SP 800-34 Rev. 1 §3.2.1
2. Question 2 — Which plan restores the systems? A fire makes a company's main office unusable for weeks. Staff can work from another location, but the servers in the damaged building must be brought back up at an alternate site before normal operations can resume. Which plan is PRIMARILY designed for restoring the operability of those systems at the alternate site? A — Business Continuity Plan. B — Cyber Incident Response Plan. C — Crisis Communications Plan. D — Disaster Recovery Plan. Answer: D — Disaster Recovery Plan. The DRP is the information system-focused plan for major disruptions that deny access to the primary facility, designed to restore operability of the target systems at an alternate site — the stem's wording tracks that definition, which is what settles it over the business continuity plan, whose defined job is sustaining the mission and business processes during and after the disruption, not restoring systems. The cyber incident response plan addresses cyber attacks, not facility loss, and the crisis communications plan is about communications. Source: NIST SP 800-34 Rev. 1 §2.2.6 · §2.2.1 · §2.2.5

Sources

Sources: ISC2 CC Certification Exam Outline (v01/2026, effective September 1, 2026) ↗ · NIST SP 800-61 Rev. 3 — Incident Response Recommendations and Considerations ↗ · NIST CSRC — SP 800-61 Rev. 2 record (withdrawn April 3, 2025) ↗ · NIST SP 800-34 Rev. 1 — Contingency Planning Guide for Federal Information Systems ↗ · NIST Cybersecurity Framework (CSF) 2.0 ↗