Certified Information Security Manager (CISM)Incident ManagementHard
A global manufacturing company experiences a cyber-physical incident where ransomware encrypts critical production control systems, halting operations across several plants. The CISO needs to prioritize recovery efforts. Which of the following is the MOST critical initial step to inform recovery prioritization?
- AEngaging law enforcement and regulatory bodies immediately.
- BConducting a rapid business impact analysis (BIA) specific to the current outage.
- CRestoring data from the latest available backups for all affected systems.
- DEstablishing secure communication channels for the incident response team.
Show answer & explanationAnswer & explanation
Correct answer: B. Conducting a rapid business impact analysis (BIA) specific to the current outage.
While all options are important, a rapid BIA tailored to the current incident is paramount. It provides real-time information on which systems and processes are most critical to business operations and financial impact, guiding the most effective recovery prioritization when resources are limited.
Why the other options are wrong
- A. Engaging external parties is important for legal and compliance reasons, but it doesn't directly dictate the technical recovery sequence.
- C. Restoring backups is a recovery action, but without knowing which systems are most critical, it might not be the most efficient first step.
- D. Secure communication is vital for IR, but it doesn't directly inform the *prioritization* of system recovery.
Rapid BIA for Incident Recovery
A focused, expedited business impact analysis performed during or immediately after a major incident to determine the current impact on critical business functions and systems, informing recovery prioritization.
- Differs from a pre-incident BIA by focusing on current, real-time impacts.
- Helps prioritize recovery efforts to minimize business disruption and financial loss.
- Essential when resources are limited and quick decisions are needed.
Memory trick: Impact analysis guides the fastest recovery path.