Which statement best differentiates incident response from disaster recovery in organizational cybersecurity planning?

Which statement best differentiates incident response from disaster recovery in organizational cybersecurity planning?

• A. Incident response detects, contains, and removes threats; disaster recovery restores business operations after a major disruption
• B. Incident response is only about data backups; disaster recovery deals with incident detection
• C. They are the same process
• D. Incident response focuses on physical security while disaster recovery focuses on software

Answer: (A)

The key idea is that incident response and disaster recovery serve different purposes in cybersecurity planning: incident response is about handling a security event as it happens, while disaster recovery is about restoring the organization’s operations after a major disruption. Incident response focuses on the immediate threat: detecting the incident, containing it to prevent further damage, eradicating the attacker or malware, and recovering affected systems while preserving evidence for analysis. It’s the active, short-term response to the incident itself. Disaster recovery, on the other hand, is about getting the business back up and running after a major disruption, which may be a cyberattack but also could be a natural disaster. It emphasizes resuming critical services, recovering IT infrastructure, and restoring data and processes, often with backups or alternate sites in play. So the best choice captures this distinction: incident response handles detection, containment, and removal of threats; disaster recovery focuses on restoring business operations after the disruption. The other options mix up the roles—backups are a disaster recovery aspect, incident detection is central to incident response, and the two are not the same process.

The key idea is that incident response and disaster recovery serve different purposes in cybersecurity planning: incident response is about handling a security event as it happens, while disaster recovery is about restoring the organization’s operations after a major disruption.

Incident response focuses on the immediate threat: detecting the incident, containing it to prevent further damage, eradicating the attacker or malware, and recovering affected systems while preserving evidence for analysis. It’s the active, short-term response to the incident itself.

Disaster recovery, on the other hand, is about getting the business back up and running after a major disruption, which may be a cyberattack but also could be a natural disaster. It emphasizes resuming critical services, recovering IT infrastructure, and restoring data and processes, often with backups or alternate sites in play.

So the best choice captures this distinction: incident response handles detection, containment, and removal of threats; disaster recovery focuses on restoring business operations after the disruption. The other options mix up the roles—backups are a disaster recovery aspect, incident detection is central to incident response, and the two are not the same process.