CISSP 18.4 - Recovery Plan Development (Part 1 of 2)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series opens recovery plan development within Domain 7, Security Operations. It looks at how a plan gets written down for the people who will actually reach for it under pressure, so a disaster response stays organized rather than becoming a guessing game the moment the expert who wrote it walks out the door.

Frequently Asked Questions

Why does a recovery plan need different documents for different readers?

A technician and an executive need very different things in a crisis, and one master document that tries to serve everyone serves no one well under stress. Instead you maintain tailored versions: an executive summary for leaders, department plans each team can refresh, technical guides for IT staff standing up alternate sites, and concise checklists for recovery team members. The point is speed of comprehension, so each reader finds their piece without wading through everyone else’s.

What belongs in an emergency response checklist?

It holds simple, clear instructions for the very first moments of a disaster, and these vary because a sudden fire allows far less time than a hurricane still a day or two out. The unbreakable rule is to order tasks by priority, most important first, since responders often will not finish the list before they have to evacuate. One critical item lives here: the formal declaration of a disaster, with clear activation criteria and a named person who holds the authority to make that call.

How do personnel contacts and assessment fit into recovery?

Your plan needs a live contact list of the people who execute recovery, and it must include backups, giving every key role alternate contact methods and a secondary person in case the primary is unreachable. Assessment runs alongside the response in a rolling fashion: first responders make a quick triage read to get recovery moving, and more detailed assessments follow to judge how well efforts are working and where to steer resources next.

What is the difference between full, incremental, and differential backups?

A full backup copies everything and resets the archive marker on each file. An incremental backup grabs only what changed since the last backup of any kind and resets the marker, so it is quick to create but slow to restore, since you replay the full plus every increment. A differential backup grabs everything changed since the last full backup and leaves the marker alone, so it grows larger but restores fast, needing only the full plus one differential.

What storage strategies keep backups safe?

Local copies are convenient for everyday requests, but you must keep at least one copy off-site, or a single disaster destroys both your systems and your only backups. A popular approach is a geographically redundant cloud service you can retrieve from anywhere, though spreading data across jurisdictions can raise new regulatory duties. Most organizations blend backup types with a rotation scheme, and your recovery point objective drives the design, because less tolerable data loss means more frequent backups.

Reference: This article is based on concepts discussed in CISSP 18.4 - Recovery Plan Development (Part 1 of 2).