Chapter 10: Planning for Contingencies Key Terms

adverse events

Events with negative consequences that could threaten an organization’s information assets or operations.

contingency planning (CP)

The actions taken by senior management to specify organizational priorities and actions when an adverse event becomes an incident or disaster.

business impact analysis (BIA)

Assessment of adverse events to determine criticality, recovery priorities, and organizational impact.

Recovery point objective (RPO)

The point in time to which data must be restored; maximum acceptable data loss.

Recovery time objective (RTO)

The maximum time a system can be unavailable before harming operations or exceeding the MTD.

Maximum tolerable downtime (MTD)

The total outage time an organization is willing to accept, including RTO and WRT.

Work recovery time (WRT)

The time needed after technical recovery to restore business processes fully.

incident response (IR)

Planning and preparation for detecting, responding to, and recovering from a cybersecurity incident.

incident

An adverse event that may result in information loss but does not threaten organizational viability.

cybersecurity incident response team (CIRT/CSIRT)

A team prepared to detect, respond to, and recover from cybersecurity incidents.

Electronic vaulting

Bulk data transfer method to send backups to an off-site facility.

Remote journaling

Backup method transferring transaction logs to an off-site facility as they occur.

Database shadowing

Creating duplicates of databases and transaction data at a remote site; combines vaulting and journaling.

Incident classification

The process of determining whether an adverse event is an actual incident.

incident commander

The manager on duty who leads the CIRT during an incident.

incident detection

Identification and classification of an adverse event as an incident.

alert roster

A contact list for notifying personnel during incidents or disasters.

alert message

A brief description of an incident used to instruct responders on initial actions.

after-action review (AAR)

Post-incident analysis from detection to full recovery to evaluate effectiveness and lessons learned.

Protect and forget

A CP philosophy focusing on defending assets and preventing recurrence rather than prosecuting attackers.

Apprehend and prosecute

CP philosophy emphasizing identifying, collecting evidence on, and prosecuting attackers.

Digital forensics

Process of preserving, identifying, extracting, documenting, and interpreting digital evidence.

e-discovery

Identification and preservation of evidence for legal action.

disaster recovery (DR)

Planning and actions to restore systems and operations after a major disruption.

business continuity (BC)

Ensures long-term organizational viability when primary operations are disrupted.

Hot site

Fully equipped facility with hardware, software, and connectivity ready for immediate use.

Warm site

Facility with many services of a hot site but missing installed software or full configuration.

Cold site

Facility with basic infrastructure but no hardware, peripherals, or ready connectivity.

Timeshare

Business continuity strategy where organizations share leased facilities.

Service bureau

An external agency paid to provide BC facilities or processing services.

Mutual agreement

Two organizations agree to assist each other with BC resources during disasters.

Rolling mobile site

A mobile, preconfigured cybersecurity/IT facility housed in a tractor-trailer.

Work-from-home

A BC strategy allowing employees to operate remotely using organizational virtual access.

business resumption planning (BRP)

The combined planning for disaster recovery and business continuity.

crisis management (CM)

Planning for risks involving injury, trauma, loss of life, or reputational harm during disasters.

Desk check

Plan review where responders read and verify CP/IR/DR components.

Structured walk-through

A physical walkthrough where participants review and discuss their response steps.

talk-through

A discussion-only walk-through performed in a conference room.

Simulation

A role-playing test that imitates an actual disaster scenario.

Full-interruption testing

A comprehensive test where systems are shut down and recovery procedures are fully executed.