Assessment, Incident, and Recovery Decisions Quick Reference for CISSP

Assessment, incident, and recovery questions all begin with purpose. What decision must be supported, what authority applies, what evidence is needed, and what business requirement controls the answer?

A more aggressive test is not automatically better. A faster recovery site is not automatically justified. A containment action is not automatically authorized. Choose the method that fits the objective, scope, impact, and approved process.

Start with purpose, authority, and scope

Before selecting a method:

Define the purpose. Assurance, discovery, exploitation, compliance, incident handling, or recovery?
Confirm authority. Who approved the work, and what legal, contractual, safety, privacy, or operational limits apply?
Define scope. Which systems, data, suppliers, locations, time periods, and interfaces are included?
Choose evidence. What observations, records, tests, samples, or technical results can support the decision?
Control impact. How will the work avoid unnecessary disruption or evidence loss?
Report limitations. What was not tested, what assumptions were made, and how reliable is the conclusion?
Track action. Who owns remediation, acceptance, retesting, recovery, and closure?

Separate assessment, test, audit, and monitoring

Method	Plain meaning	Best clue
Assessment	A structured evaluation of whether safeguards are suitable, implemented, and working.	Broad judgment using several kinds of evidence
Test	A specific activity used to observe behavior or produce evidence.	A defined method, expected result, and actual result
Audit	An independent comparison of evidence against stated criteria.	Conformity with law, policy, contract, or standard
Continuous monitoring	Repeated or ongoing collection and review of security information.	Change over time, control health, and timely awareness

An audit can use tests and assessment evidence. A test can support an assessment. Continuous monitoring can identify changes that trigger a deeper assessment. The terms describe different purposes, not isolated silos.

Choose among a vulnerability scan, penetration test, and red team

Method	Primary purpose	Important limitation
Vulnerability assessment	Find and prioritize known weaknesses and unsafe conditions.	A finding does not prove exploitation or business impact.
Penetration test	Attempt authorized exploitation to show what access or impact is possible.	Results are limited by scope, time, tester approach, and rules of engagement.
Red-team exercise	Test detection, response, people, process, and technology against an adversary objective.	It does not provide complete coverage of every control or weakness.

An authenticated scan usually sees more configuration and patch detail than an unauthenticated scan. An unauthenticated scan better represents what can be observed without credentials. The stronger method depends on the question, not on which tool sounds more advanced.

Evaluate evidence and error types

Evidence should be relevant, reliable, sufficient, protected, and traceable to the scope and method.

A false positive reports a problem that is not actually present.
A false negative misses a problem that is present.

Reducing one error type can increase the other. Aggressive alerting may find more true problems while also producing more false positives. Conservative thresholds may reduce noise while missing subtle activity.

Sampling also creates limits. A clean sample does not prove every item is clean. A finding in one sample does not automatically describe the entire population. Report what the evidence supports and what remains unknown.

Follow incident authority and sequence

A practical incident sequence is:

Prepare. Establish plans, roles, contacts, tools, logging, training, and authority.
Detect and analyze. Validate the event, determine scope and impact, preserve relevant evidence, and classify priority.
Contain. Limit harm while considering business impact, evidence, safety, and attacker behavior.
Eradicate. Remove malicious access, persistence, unsafe configurations, and affected components.
Recover. Restore from trusted sources, validate operation, monitor closely, and return services according to priority.
Learn and improve. Record lessons, correct root causes, update controls and plans, and track actions to closure.

The exact actions depend on the incident. Immediate isolation may be correct for destructive malware, while covert monitoring may be authorized in another investigation. The key is approved decision authority and evidence-based action.

CISSP clue: Preserve life and safety first, follow law and authority, protect evidence, limit harm, restore priority services, and improve the program afterward.

Separate business continuity from disaster recovery

Business continuity keeps critical business activities operating at an acceptable level during and after disruption. It includes people, facilities, suppliers, communications, manual workarounds, technology, and decision authority.

Disaster recovery restores technology, data, infrastructure, and supporting services after a serious disruption.

Disaster recovery supports business continuity. Restoring servers is not enough when people, facilities, identity services, networks, suppliers, or business procedures remain unavailable.

Use the recovery objectives correctly

Term	Question it answers
Maximum Tolerable Downtime (MTD)	How long can the business process remain disrupted before the harm becomes unacceptable?
Recovery Time Objective (RTO)	How quickly should the service or capability be restored?
Work Recovery Time (WRT)	After technology returns, how much time is needed to restore operations and clear backlogs?
Recovery Point Objective (RPO)	How far back may recovered data go, measured in time?

The RTO plus the WRT should fit inside the MTD. RPO is about acceptable data loss, not how quickly the system returns.

A short objective usually requires more expensive capabilities, stronger dependencies, more frequent replication or backup, and more testing. The objective should come from the Business Impact Analysis, not from whichever technology is already owned.

Compare recovery sites

Site	What is ready	Typical tradeoff
Hot site	Facilities, systems, connectivity, and current or near-current data are prepared for rapid use.	Fast recovery with high cost and ongoing synchronization needs.
Warm site	Some infrastructure and connectivity are ready, but data, configuration, or capacity requires additional work.	Moderate recovery time and cost.
Cold site	The facility and basic utilities are available, but systems, data, and configuration must be supplied.	Lower cost with slow recovery.

A reciprocal agreement relies on another organization providing space or resources during disruption. It can be inexpensive but uncertain when both parties are affected or need the same limited capacity.

Cloud recovery can provide flexible capacity and geographic separation, but it still depends on identity, network connectivity, provider availability, configuration, keys, data protection, cost, and tested procedures.

Choose an exercise by the evidence needed

Exercise	What happens	What it proves
Read-through or checklist review	Participants review the plan and confirm names, steps, contacts, and resources.	Basic document completeness, not operational capability.
Tabletop	Participants discuss how they would respond to a scenario.	Roles, decisions, communications, assumptions, and gaps.
Walkthrough	Participants step through procedures, locations, equipment, and handoffs more directly.	Practical access and sequence beyond discussion alone.
Simulation	Teams perform selected response and recovery actions in a controlled scenario.	More realistic coordination and technical capability without full production interruption.
Parallel test	Recovery systems process work while production continues.	Recovery capability with reduced production risk.
Full interruption	Production is stopped and the recovery capability must carry the work.	The strongest operational evidence with the greatest business risk.

Use the least disruptive method that produces the evidence required, then increase realism as capability and business approval allow.

Scenario comparisons

Leadership wants proof that required controls meet a contract

An independent audit against the stated criteria is the strongest fit. Tests and assessments may supply evidence to the audit.

The security team wants a broad list of known weaknesses

Use a vulnerability assessment. A penetration test may later validate selected paths and impact.

An alert is confirmed while destructive activity is continuing

Containment may need to happen quickly under the incident plan. Preserve evidence where practical, but do not allow avoidable harm simply to collect more data.

A business process can tolerate six hours of disruption

The combined technology restoration and work recovery should fit inside that maximum. The RTO alone should not consume the entire six hours when users still need time to validate data and clear backlogs.

Management wants a low-risk exercise of roles and decisions

Use a tabletop. It can reveal unclear authority, missing contacts, supplier assumptions, and communication gaps without interrupting production.

Common exam traps

Calling every technical check an audit.
Assuming a penetration test provides complete coverage.
Treating a vulnerability finding as proof of exploitation.
Confusing false positives with false negatives.
Taking high-impact incident action without checking authority and business effect.
Treating RPO as recovery speed.
Choosing a hot site without a business requirement that justifies the cost.
Assuming a backup proves recoverability without restore testing.
Treating a tabletop as proof that systems can actually recover.
Restoring technology while ignoring people, facilities, suppliers, identity, and communications.

Rapid review grid

Need	Best match
Broad evaluation using several evidence sources	Assessment
Independent comparison against stated criteria	Audit
Find known weaknesses broadly	Vulnerability assessment
Demonstrate authorized exploitation and impact	Penetration test
Test detection and response against an adversary objective	Red-team exercise
Set acceptable restoration time	RTO
Set acceptable data loss measured in time	RPO
Discuss roles and decisions without production impact	Tabletop
Provide the strongest recovery evidence	Full-interruption test, when authorized and justified