An overview of IR and DR

While organizations would prefer to prevent security breaches and incidents, they must expect the unexpected and plan for the worst. In module 1, we introduced the five core functions of the NIST Cybersecurity Framework (CSF):

1. Identify: identify and prioritize assets, vulnerabilities, and threats
2. Protect: implement safeguards to prevent, detect, and respond to attacks
3. Detect: establish and maintain continuous monitoring capabilities
4. Respond: develop and implement incident response plans and procedures
5. Recover: establish and maintain business continuity and disaster recovery capabilities

The reality is there are no foolproof safeguards and incidents may occur. We must be prepared when the "protect" function fails, and this entails the ability to detect an incident and then respond to it. In other words, we need planning.

Planning is an essential aspect of information security. It is the process of identifying potential security risks and developing strategies to mitigate or avoid them. Without proper planning, organizations are vulnerable to security incidents that can cause significant damage to their operations and reputation. A comprehensive security plan helps an organization to identify its critical assets, assess its vulnerabilities, and develop a response plan in case of an incident. It also helps an organization to comply with industry regulations and standards, and demonstrate due diligence to stakeholders. By taking a proactive approach to information security, organizations can reduce the likelihood of security incidents occurring and minimize the impact if they do occur.

Definitions

Before we dig deeper into IR and DR, let us discuss few important concepts:

Incidents

In the context of information security, an incident refers to any event that poses a threat to an organization's information systems, network, or data. This can include a wide range of events, such as cyber attacks, data breaches, system failures, and natural disasters. Some examples of security incidents include:

• A hacker gaining unauthorized access to an organization's network
• An employee mistakenly disclosing sensitive information
• A malware infection spreading across an organization's systems
• A natural disaster causing damage to an organization's data center
• A power failure that causes systems to go offline

It is important to note that an incident does not have to result in a data loss or damage for it to be considered as an incident, any event that pose a potential threat to the organization's information system is considered as an incident.

Contingency planning

Contingency planning, also known as business continuity planning, is the process of identifying potential risks and disruptions that may affect an organization's operations, and developing strategies to mitigate or avoid them. In the context of information security, contingency planning is the process of preparing for and responding to security incidents and disasters that may impact an organization's information systems, network, or data.

The goal of contingency planning is to ensure that an organization can continue to operate in the event of a security incident or disaster. It involves identifying critical systems and data, assessing vulnerabilities, and developing procedures for restoring operations as quickly as possible. This includes identifying alternative facilities, equipment, and personnel that can be used in case of an incident, and testing and maintaining the readiness of the organization to respond to an incident.

It is important to note that contingency planning is a continuous process that requires regular review, testing, and updating to ensure that it remains effective in the face of changing threats and vulnerabilities.

Incident response (IR)

Incident response refers to the processes and procedures that an organization follows when a security incident occurs. It is the process of identifying, containing, assessing, and resolving security incidents. The goal of incident response is to minimize the impact of an incident and return the organization to normal operations as quickly as possible.

Incident response includes several key phases [1]:

1. Preparation
2. Identification
3. Containment
4. Analysis (Assessment)
5. Eradication
6. Recovery
7. Post-Incident Activity (Lessons learned)

Disaster recovery (DR)

Disaster recovery (DR) is the process of restoring critical systems, networks, and data after a disaster occurs. The goal of disaster recovery is to minimize the impact of a disaster on an organization's operations and ensure that essential systems and data are available as quickly as possible.

Disaster recovery includes several key elements [2]:

1. Risk Management
2. Business Impact Analysis
3. Backup and recovery strategies
4. Alternate site
5. Testing
6. Maintenance

Business Continuity (BC)

Business continuity refers to the ability of an organization to maintain its operations and critical functions during and after a disruptive event. The goal of business continuity is to minimize the impact of a disruptive event on an organization's operations, and to ensure that essential systems, applications, and data are available as quickly as possible.

The need for IR and DR

Incident response and disaster recovery are critical components of an overall information security strategy. They are designed to minimize the impact of security incidents and disasters on an organization's operations and to ensure that essential systems, applications, and data are available as quickly as possible.

The importance of incident response lies in its ability to quickly identify, contain, and resolve security incidents. This minimizes the impact of the incident and helps to prevent it from spreading. Additionally, incident response helps organizations to quickly restore normal operations and protect their reputation by controlling the spread of information about the incident.

Disaster recovery is equally important as it provides an organization with the capability to restore critical systems, applications, and data in the event of a disaster. This enables an organization to continue its operations and minimize the impact of the disaster on its customers, partners, and stakeholders.

Both incident response and disaster recovery are also important for compliance reasons as many regulations and standards, such as the General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCI DSS) require organizations to have incident response and disaster recovery plans in place.

Goals of IR and DR

The goals of incident response and disaster recovery are closely related and are designed to minimize the impact of security incidents and disasters on an organization's operations [2].

The main goals of incident response are:

1. To quickly identify security incidents: This includes monitoring systems and networks for unusual activity, and having processes in place to quickly detect and respond to security incidents.
2. To contain security incidents: This includes isolating affected systems and networks, shutting down affected services and applications, and preventing the spread of the incident to other systems and networks.
3. To resolve security incidents: This involves taking steps to eliminate the cause of the incident and to restore normal operations.
4. To protect the organization's reputation by controlling the spread of information about the incident.
5. To meet regulatory and compliance requirements.
6. To minimize the impact of the incident on the organization's operations and customers, partners, and stakeholders.

The main goals of disaster recovery are:

1. To ensure the availability of critical systems, applications, and data in the event of a disaster.
2. To minimize the impact of a disaster on an organization's operations and customers, partners, and stakeholders.
3. To restore normal operations as quickly as possible in the event of a disaster.
4. To protect the organization's reputation by controlling the spread of information about the disaster.
5. To meet regulatory and compliance requirements.
6. To maintain continuity of business operations and minimize the impact on the organization's customers, partners, and stakeholders.

References

---

[1] "Incident Response & Computer Forensics, Third Edition" by Jason T. Luttgens, Matthew Pepe, and Kevin Mandia.
[2] "Information Security Management Handbook, Seventh Edition" by Harold F. Tipton and Micki Krause.

Incident Response

Incident response refers to the process of identifying, containing, eliminating, and recovering from security incidents.

Stages of incident response
1 - Preparation

The preparation phase involves establishing the policies, procedures, and teams necessary to effectively respond to security incidents. This includes developing incident response policies, procedures, and teams, as well as defining communication and reporting protocols and providing incident response training.

The preparation phase is critical to ensuring an effective incident response. Without proper preparation, an organization may be unable to respond to security incidents in an organized and effective manner, leading to increased damage and disruption. By establishing clear policies, procedures, and teams, and providing incident response training, organizations can increase their readiness to respond to incidents, minimize the damage and disruption caused by incidents, and recover from incidents more quickly.

The preparation stage includes:

Incident Response Policies

During the preparation stage, we must Develop policies that outline the organization's approach to incident response, including the types of incidents that will trigger an incident response, who is responsible for responding to incidents, and the roles and responsibilities of incident response team members.

IR policies in an organization are typically developed by a combination of stakeholders, including senior leadership, information security, legal, and human resources departments.

Incident response procedures

We must also establish clear procedures for responding to incidents that ensure effective, efficient, and consistent responses.

Incident response teams

Organizations must select individuals or teams responsible for responding to incidents and assigning clear roles and responsibilities.

Incident response teams are groups of individuals within an organization who are responsible for responding to security incidents. The exact composition of an incident response team will depend on the size and structure of the organization and the types of incidents they may encounter.

In general, incident response teams should include individuals with a range of technical and business skills, including information security, network administration, system administration, database administration, legal, and human resources. The goal is to ensure that the incident response team has the necessary knowledge and skills to respond to incidents effectively and efficiently.

Communication and reporting protocols

Another important aspect of the prepration stage is to outline the process by which incidents are communicated and reported within an organization. This includes defining who will be notified of an incident, how incidents will be communicated and reported, and what types of information will need to be collected and reported.

Effective communication and reporting protocols are critical to ensuring an effective incident response. They help to ensure that incidents are communicated and reported quickly and accurately, and that the incident response team has the information they need to respond to incidents effectively.

When defining communication and reporting protocols, organizations should consider the following:

• Who needs to be notified of an incident: This may include senior leadership, the incident response team, legal, human resources, and other relevant stakeholders.
• How incidents will be communicated and reported: This may include email, phone, SMS, or other forms of communication, as well as the use of incident response management tools and platforms.
• What types of information need to be collected and reported: This may include details on the type of incident, the scope and impact of the incident, and any relevant information on the cause of the incident.

Testing incident response plans

Testing refers to the process of validating and testing the policies, procedures, and teams established in the preparation phase. The goal of testing incident response plans is to ensure that they are effective and capable of responding to incidents.

Testing IR plans can take many forms, including scenario-based exercises, tabletop exercises, and simulated incidents. These exercises can help to identify any gaps or weaknesses in the incident response plans, and allow organizations to refine their policies, procedures, and teams as needed.

2 - Identification

The identification stage in IRrefers to the process of detecting and confirming the presence of an incident. This stage is critical because it sets the stage for the subsequent stages of incident response, and helps to ensure that the incident response team is able to respond to the incident effectively.

The goal of the identification stage is to quickly and accurately detect and confirm the presence of an incident, and to collect and preserve as much information about the incident as possible. To achieve this goal, organizations typically employ a combination of monitoring and detection technologies, such as intrusion detection systems, anti-virus and anti-malware tools, and log analysis tools.

When an incident is detected, it is important to quickly and accurately assess the scope and impact of the incident, and to determine if the incident is a true security breach. This assessment should be done in a systematic and repeatable manner, and should be based on a pre-defined set of criteria.

Once an incident has been confirmed, the incident response team should be notified, and a plan of action should be developed to contain, assess, and respond to the incident. It is important to document all actions taken during the identification stage, as this information will be used to inform the subsequent stages of incident response.

The following is an example of incident identification in a network security context:

1. Detection: The intrusion detection system (IDS) detects an abnormal pattern of network traffic, such as a high volume of incoming traffic from a single IP address.
2. Alarm: The IDS raises an alarm and generates an alert, which is sent to the security operations center (SOC).
3. Verification: The SOC analyzes the alert and verifies that it is a genuine security incident. This may involve reviewing logs, checking for signs of compromise, and consulting with other security tools and systems.
4. Confirmation: If the SOC determines that a security incident has occurred, it confirms the presence of an incident and notifies the incident response team.
5. Information collection: The incident response team collects as much information about the incident as possible, including the time of the incident, the affected systems, the type of attack, and any other relevant details.

3 - Containment

The containment stage in incident response refers to the process of isolating the affected systems and stopping the spread of the incident. This stage is critical because it helps to minimize the damage caused by the incident and to prevent the incident from spreading to other systems or networks.

The goal of the containment stage is to quickly and effectively contain the incident and prevent further damage. To achieve this goal, the incident response team may take a number of actions, such as disconnecting affected systems from the network, isolating the affected systems, or implementing other technical or procedural controls to stop the spread of the incident.

It is important to carefully consider the containment strategy, as the wrong containment strategy can actually make the situation worse. For example, disconnecting affected systems from the network may prevent the incident from spreading, but it may also result in data loss or other unintended consequences.

In addition to technical containment measures, the incident response team should also consider non-technical containment measures, such as communication and coordination with other stakeholders, such as law enforcement or regulatory agencies.

Continuing from the identification example above: Suppose an intrusion detection system (IDS) detected a high volume of incoming traffic from a single IP address and raised an alarm, which was verified by the security operations center (SOC) as a genuine security incident. The incident response team was notified and collected information about the incident. In the containment stage, the incident response team may take the following actions:

1. Disconnect the affected systems from the network: The incident response team may physically disconnect the affected systems from the network to prevent the spread of the incident.
2. Isolate the affected systems: The incident response team may place the affected systems in a quarantine area or on a separate network segment to prevent the spread of the incident.
3. Implement technical controls: The incident response team may implement technical controls, such as firewalls or access controls, to stop the spread of the incident.
4. Coordinate with other stakeholders: The incident response team may coordinate with other stakeholders, such as law enforcement or regulatory agencies, to contain the incident and prevent further damage.

4 - Analysis (Assessment)

Once the incident has been contained, the incident response team can then move on to the next stage of incident response, which is assessment. The information gathered during the containment stage will be used to inform the assessment stage and to help the incident response team determine the best course of action to respond to the incident.

The analysis stage in incident response is the process of collecting and analyzing information about the incident to determine the cause and impact of the incident. The goal of this stage is to understand the full extent of the incident, including what systems and data were affected, what caused the incident, and what impact the incident has had on the organization.

The incident response team will use a variety of tools and techniques to gather information about the incident, including reviewing system and network logs, interviewing personnel, and conducting forensic examinations of affected systems.

The information gathered during the analysis stage will be used to determine the root cause of the incident, to determine the extent of the damage, and to develop a plan of action to respond to the incident. The incident response team may also need to coordinate with other stakeholders, such as law enforcement or regulatory agencies, to gather additional information about the incident.

5 - Eradication

The eradication stage in incident response is the process of resolving the incident and restoring the affected systems to their normal state. The goal of this stage is to remove the cause of the incident and to restore normal operations as quickly as possible.

The incident response team will use the information gathered during the analysis stage to determine the best course of action to resolve the incident. This may include steps such as cleaning up infected systems, patching vulnerabilities, and restoring data from backups.

In some cases, it may also be necessary to implement additional security measures to prevent similar incidents from occurring in the future. This could include deploying new security technologies, updating security policies, or retraining personnel on security best practices.

It is important to thoroughly eradicate the incident to ensure that the cause of the incident is fully removed and that the systems are restored to their normal state. A well-executed eradication stage can help to minimize the impact of the incident and to prevent similar incidents from occurring in the future.

Example: The incident response team, after conducting a thorough analysis of the incident, discovered that the email account was compromised by a phishing attack. The attacker was able to gain access to the email account by tricking the employee into entering their login credentials on a fake login page. During the eradication stage, the incident response team took the following actions to resolve the incident:

1. Reset the employee's password: To prevent the attacker from continuing to access the email account, the incident response team reset the employee's password.
2. Cleared the infected email account: The incident response team cleared the infected email account of any malicious content and restored it to its normal state.
3. Traced and blocked the source of the phishing attack: The incident response team traced the source of the phishing attack and took steps to block it to prevent similar attacks in the future.
4. Educated employees on security best practices: To prevent similar incidents from occurring in the future, the incident response team conducted a training session for all employees on how to identify and avoid phishing attacks.

6 - Recovery

The recovery stage in incident response is the process of resuming normal operations and returning the organization to business as usual. This stage begins once the incident has been resolved and the affected systems have been restored to their normal state.

During the recovery stage, the IR team will need to assess the impact of the incident and determine the steps necessary to resume normal operations. This may include tasks such as restoring systems and data, reestablishing communication and data networks, and testing systems to ensure they are functioning properly.

In some cases, it may also be necessary to make changes to the organization's security posture in response to the incident. For example, if the incident was caused by a vulnerability that was exploited, the organization may need to implement additional security measures to prevent similar incidents from occurring in the future.

It is important to thoroughly recover from the incident to ensure that the organization is able to return to business as usual as quickly as possible. A well-executed recovery stage can help to minimize the impact of the incident and to prevent similar incidents from occurring in the future.

Continuing with the example from the "Eradication" stage, where an employee's email account was compromised. In the recovery stage, the IR team took the following actions:

1. Restored the email account: The IR team restored the employee's email account to its normal state, including all previous emails, contacts, and other data.
2. Resumed normal operations: The IR team tested the email account and the related systems to ensure they were functioning properly and were free of any remaining malicious content.
3. Evaluated the incident: The IR team conducted a thorough evaluation of the incident to determine the root cause and identify any areas for improvement in the organization's IR plan.
4. Implemented security improvements: Based on the evaluation of the incident, the IR team implemented additional security measures to prevent similar incidents from occurring in the future. This may include employee training on security best practices, the implementation of anti-phishing technologies, and the creation of security policies and procedures.

By thoroughly recovering from the incident, the incident response team was able to minimize the impact of the incident, restore normal operations, and prevent similar incidents from occurring in the future. This demonstrates the importance of having a well-planned and well-executed incident response plan in place to effectively respond to security incidents.

7 - Post-Incident Activity

The post-incident activity stage in incident response is the process of reviewing the incident and evaluating the effectiveness of the incident response plan. This stage is critical for ensuring that the organization is better prepared to respond to future incidents and that any areas for improvement in the incident response plan are identified and addressed.

During the post-incident activity stage, the incident response team will need to review the incident and the actions taken during the incident response process. This may involve tasks such as conducting a root cause analysis, reviewing the documentation of the incident, and interviewing team members involved in the response effort.

Based on the results of the review, the incident response team will then evaluate the effectiveness of the incident response plan and identify areas for improvement. This may include updating the incident response plan, providing additional training to team members, and improving the organization's security posture.

Example - After a phishing attack was successfully contained and eradicated, the incident response team conducted a post-incident activity review. This involved the following actions:

1. Root cause analysis: The incident response team conducted a root cause analysis to determine how the attacker was able to successfully carry out the phishing attack. The team also identified any areas for improvement in the organization's security posture.
2. Incident documentation review: The incident response team reviewed the documentation of the incident, including the incident response plan, incident response logs, and incident response reports.
3. Interviews with team members: The incident response team conducted interviews with team members involved in the response effort to gather additional information and feedback on the incident response process.
4. Evaluation of incident response plan: Based on the results of the root cause analysis and the documentation review, the incident response team evaluated the effectiveness of the incident response plan. The team identified areas for improvement in the plan, such as updating the incident response procedures, providing additional training to team members, and improving the organization's security posture.
5. Implementation of improvements: Based on the evaluation of the incident response plan, the incident response team implemented the identified improvements to better prepare the organization for future incidents.

References

---

[3] NIST SP 800-61: Computer Security Incident Handling Guide
[4] ISO/IEC 27035: Information technology – Security techniques – Information security incident management
[5] SANS Institute: Incident Response and Computer Forensics

Disaster Recovery

Disaster recovery refers to the process of restoring systems, data, and operations to a normal state after a disaster or major disruption has occurred. A disaster can be defined as any event that severely disrupts normal business operations and threatens the availability of critical systems and data. Disaster recovery is a critical component of an organization's overall business continuity plan and is designed to minimize the impact of a disaster on business operations. The goal of disaster recovery is to ensure that critical systems and data are restored as quickly as possible and that business operations can resume as normal. This is achieved through the creation of a comprehensive disaster recovery plan that outlines the procedures and processes for responding to disasters and restoring critical systems and data.

Table 6.1: Types of Disasters

disaster recovery planning

Disaster recovery planning is the process of creating a comprehensive plan for how an organization will respond to and recover from a potential disaster. The goal of disaster recovery planning is to minimize the impact of a disaster on an organization's operations and to ensure that critical systems and data can be restored as quickly as possible.

A well-designed disaster recovery plan should include the following components:

Risk Management

This element of disaster recovery involves identifying and evaluating potential threats to an organization's IT infrastructure and data, and implementing measures to minimize or mitigate these risks. This may include conducting regular security assessments, implementing disaster recovery plans, and performing regular backups.

Business Impact Analysis (BIA)

BIA is a process of evaluating the potential impact of a disaster on an organization's operations, including the impact on revenue, customers, employees, and other stakeholders. This information is used to prioritize the critical systems and data that must be protected in the event of a disaster.

Backup and recovery strategies

Backup and recovery strategies are key components of a disaster recovery plan. These strategies should include regularly scheduled backups of critical systems and data, as well as plans for how to restore data and systems in the event of a disaster. The backup and recovery strategies should also include considerations for data protection and security, such as data encryption and secure storage of backup copies.

Alternate site

An alternate site is a location where critical systems and data can be relocated in the event of a disaster. This can include an off-site data center, a cloud-based solution, or a secondary physical location. The alternate site should be equipped with the necessary hardware and software to support the organization's operations in the event of a disaster.

Testing

Regular testing of disaster recovery plans and procedures is essential to ensure that the plans are effective and that all stakeholders are prepared to respond in the event of a disaster. This may include regular simulated disaster scenarios, as well as regular testing of backup and recovery procedures.

Maintenance

Regular maintenance and updating of disaster recovery plans and procedures is essential to ensure that the plans remain effective and up-to-date. This may include updating backup and recovery procedures, reviewing and revising risk management strategies, and performing regular security assessments. Regular training for all stakeholders involved in disaster recovery is also important to ensure that everyone is prepared to respond effectively in the event of a disaster.

Disaster recovery execution

Disaster recovery execution refers to the actual implementation of the disaster recovery plan in response to a disaster. This stage of disaster recovery is crucial as it determines the success of the overall disaster recovery effort. Among other steps, recovery execution includes the following steps:

1. Activation: The process of activating the disaster recovery plan in response to a disaster. This may involve notifying the disaster recovery team, activating the alternate site, and communicating with stakeholders.
2. Containment: An important step in the disaster response and recovery process. The goal of containment is to minimize the impact of a disaster and prevent it from spreading and causing further damage.

Alternate sites

Alternate sites are backup facilities or locations that can be used as a replacement for a primary site in the event of a disaster. They are used to support the continuation of critical business operations during and after a disaster. The following are some of the common types of alternate sites (description is provided in the table below):

1. Hot site>
2. Cold site>
3. Mobile site>
4. Cloud-based site

Table 6.2: Types of Alternate Sites

References

---

[6] Disaster Recovery Institute International: Best Practices in Disaster Recovery and Business Continuity Planning

Incident Response case study
Ransomware Attack at CSA Corporation
Problem

CSA Corporation, a large financial services company, experienced a ransomware attack that encrypted critical data on its servers, rendering it inaccessible. The attackers demanded a large sum of money in exchange for the decryption key.

Solution

CSA Corporation immediately activated its incident response plan and formed an incident response team to contain and analyze the attack. The team performed the following steps:

1. Identification: The incident response team identified the attack as a ransomware attack based on the encrypted files and the ransom demand.
2. Containment: To prevent the attack from spreading, the team isolated the infected systems and restricted network access to prevent further data encryption.
3. Analysis: The incident response team analyzed the attack to determine the cause and extent of the compromise. They found that the attack originated from a phishing email that was sent to an employee.
4. Eradication: To eradicate the attack, the team wiped the infected systems and restored the data from backups.
5. Recovery: The incident response team worked with the IT and security teams to recover the systems and data, ensuring that the systems were properly secured and patched to prevent future attacks.
6. Post-Incident Activity: The incident response team conducted a post-incident review to identify areas for improvement in the incident response plan and to share lessons learned with the organization.

Results

CSA Corporation was able to successfully recover its data and systems and prevent the attack from spreading further. The incident response team was able to contain and eradicate the attack in a timely manner, minimizing the impact on the business.

Case Study Questions

Attempt to answer the following questions before revealing the model answers:

1. How did the incident response team determine that the attack was a ransomware attack?
2. What steps did the incident response team take to contain the attack and prevent it from spreading?
3. How did the incident response team recover the data and systems and prevent future attacks?
4. What areas for improvement were identified in the incident response plan and how were they addressed?

Show Model Answers

Research Assignment
Investigating the Importance of Incident Response and Disaster Recovery Planning: A Case Study Analysis
Introduction

Incident response and disaster recovery are critical components of a comprehensive information security program. The ability to quickly and effectively respond to and recover from incidents can mean the difference between minor inconvenience and major business disruption. In this research assignment, students will explore the concepts, processes, and best practices of incident response and disaster recovery.

Instructions

1. Conduct a thorough review of the literature on incident response and disaster recovery. This should include academic journals, industry reports, and best practices guidelines
.
2. Choose a real-life case study of an incident response and disaster recovery effort. This case study should describe the problem, the solution, the results, and any lessons learned.
3. Analyze the case study in depth, focusing on the following:
   a. The incident response process followed in the case study, including identification, containment, analysis, eradication, recovery, and post-incident activity.
   b. The disaster recovery process followed in the case study, including risk management, business impact analysis, backup and recovery strategies, alternate site, testing, and maintenance.
   c. The effectiveness of the incident response and disaster recovery efforts, including what worked well and what could have been done better.
4. Based on your review of the literature and analysis of the case study, develop recommendations for best practices in incident response and disaster recovery.

Deliverables

1. A written report that includes:
   a. An overview of the literature on incident response and disaster recovery.
   b. A detailed analysis of the chosen case study, including a description of the incident response and disaster recovery efforts, the results, and any lessons learned.
   c. Recommendations for best practices in incident response and disaster recovery.
2. A video presentation that summarizes the written report and highlights the key findings and recommendations.

Suggested Sources

• NIST SP 800-61: Computer Security Incident Handling Guide
• ISO/IEC 27035: Information technology – Security techniques – Information security incident management
• SANS Institute: Incident Response and Computer Forensics
• Disaster Recovery Institute International: Best Practices in Disaster Recovery and Business Continuity Planning
• Federal Emergency Management Agency: Emergency Management Institute

Assessment Criteria

• Identify and critically evaluate the relevant literature on incident response and disaster recovery.
• Analyze the incident response and disaster recovery efforts described in the case study, including an evaluation of the effectiveness of the efforts and any lessons learned.
• Develop practical, actionable recommendations for best practices in incident response and disaster recovery based on the literature and the case study analysis.
• The research report should be well-written, organized, and easy to understand. The report should be free of errors and should be appropriately formatted and referenced.