CISSP 18.5 - Training, Awareness, & Documentation

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series turns to how a recovery plan reaches the people who must use it, within Domain 7, Security Operations. It looks at making a plan known, available, and protected, so that a well-written binder is not left unreachable or unpracticed at the exact moment the lights go out.

Frequently Asked Questions

Who needs recovery training, and at what depth?

Everyone touched by the plan, but not everyone to the same degree. New hires get orientation training as a baseline, and anyone stepping into a recovery role for the first time gets initial training on that role. Core recovery team members need detailed refreshers to keep their skills sharp, while the wider workforce only needs light awareness reminders folded into regular meetings or a periodic email newsletter. Match the depth to the responsibility, so critical players stay fluent while everyone else stays aware.

How should the recovery plan be documented and controlled?

Fully, and as a living document. Keep the documentation current, updating it every time the plan changes, because an outdated plan can be worse than none. Use formats that make small updates painless, so a single revised page does not force a full reprint. Because these plans change often, many organizations publish them on a secured part of the intranet for easy access, but that convenience hides a risk: a real disaster may take the intranet down, so keep enough current printed copies at both your primary and alternate sites.

How do you protect a plan that is also sensitive?

Treat it as confidential and share it on a need-to-know basis. Each participant should fully understand their own role, but they do not need the entire plan, so you compartmentalize access. At the same time, avoid the opposite failure: key team members and senior management must have the complete plan and grasp the high-level implementation, because you never want all that knowledge locked inside one person’s head. The balance is wide enough that recovery survives the loss of any individual, tight enough that the plan does not leak.

Why does training and documentation matter for a recovery plan?

A beautifully written plan is worthless if responders have never practiced it or cannot find it when the lights go out. A recovery binder that sits on an intranet which goes dark the moment a storm hits becomes unreachable exactly when it is needed. The goal is to make the plan both known and available at the precise moment it is called, which means tiered training so people can execute their part and stored copies a disaster cannot make unreachable.

Reference: This article is based on concepts discussed in CISSP 18.5 - Training, Awareness, & Documentation.