Skip to main content

Incident Response and Business Continuity

Incident response (IR) and business continuity (BC) are the disciplines that determine how an organization behaves when something goes wrong. IR addresses security incidents - a compromised account, a ransomware outbreak, a data breach - and focuses on detecting, containing, eradicating and recovering. Business continuity addresses disruption to critical business functions, regardless of cause, and focuses on keeping the organization operating through the disruption. The two disciplines overlap in crisis management and share the same governance layer.

This subcategory covers the full lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. It also covers business impact analysis, recovery objectives, continuity planning, crisis communications, and the metrics and testing that prove the plans work.

The material is written for SOC leads, incident responders, business continuity managers, CISOs, and security managers. It maps to CISSP Domain 7 (Security Operations), CISM Domain 4 (Information Security Incident Management), Security+ SY0-701 Domain 4 (Security Operations) and Domain 5 (Security Program Management and Oversight), and CySA+ incident response objectives.

Format​

Process-based. Each file follows the 9-section skeleton:

  1. Overview
  2. Where in the Organization
  3. Threats and Failure Modes
  4. Controls and Implementation
  5. Tooling
  6. Verification and Metrics
  7. Anti-Patterns
  8. Certification Alignment
  9. References

Files​

#FileFormat
01Incident Response Fundamentalsprocess-based
02Incident Response Lifecycleprocess-based
03Business Continuity and Disaster Recoveryprocess-based
04Crisis Management and Communicationsprocess-based
05Incident Response Metrics and Testingprocess-based

References​