CISSP 18.1 - The Nature of Disaster (Part 1 of 2)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series opens disaster recovery planning in Domain 7 by mapping the landscape of natural disasters a recovery plan must anticipate. It covers how recovery planning relates to business continuity and why a plan built before the crisis lets staff act from muscle memory when the ground shakes or the water rises.

Frequently Asked Questions

What is disaster recovery planning, and how does it differ from business continuity?

Disaster recovery planning is the technical hands that carry out the strategy your business continuity plan designs. The business continuity plan sets priorities and decides what must survive, while the disaster recovery plan installs the controls that prevent outages and restores service fast once one hits. Business continuity is the architect drawing the blueprint, and disaster recovery is the crew that keeps the building standing and rebuilds it, though in practice one team usually owns both under a single umbrella.

What actually counts as a disaster?

A disaster is any event that stops, prevents, or interrupts your ability to do your work. A flooded processing center qualifies, and so does a fire that guts your main site or a threat that seals off an entire district. The trigger is simple: the moment your technology can no longer support mission-critical work, the recovery plan takes over. A good plan runs almost on autopilot, so trained people follow clear steps instead of debating what to do while tensions run high.

Which earth-driven hazards should top your list?

Start with earthquakes and floods, because they strike very differently. Earthquakes hit without warning, often along known fault lines, though real risk varies street by street even inside a high-hazard region. Floods build slowly as rivers overflow, or explode as flash floods and dam breaches. The practical trap is that standard business policies rarely cover flood loss, so confirm specialized coverage before the water arrives, and treat the fast-onset and slow-onset hazards as two separate response modes.

How do storms and fires threaten your operations?

Storms bundle several threats at once: high winds turn ordinary objects into projectiles, hail batters equipment, and lightning fries sensitive electronics and knocks out power. Fires are just as unforgiving, whether a wildfire races through a region or a single spark takes a critical facility. Both share one lesson, which is to watch the forecasts and warning systems for your area, because a proactive response that begins hours early beats a scramble that begins too late.

Why do pandemics and regional events belong in a disaster plan?

A pandemic leaves your buildings intact but empties them of people, since staff can no longer gather safely in one place, which forces you to plan for remote operations, contingency staffing, and coverage questions your insurance may not answer. You should also account for localized events unique to your geography, from volcanic eruptions to avalanches to mudslides. If your operations span multiple regions, bring in local emergency experts, because they carry knowledge no headquarters checklist can match.

Reference: This article is based on concepts discussed in CISSP 18.1 - The Nature of Disaster (Part 1 of 2).