Ransomware has encrypted the systems supporting order fulfillment, and the outage is expected to last several days. Staff are unsure whether the incident response plan or the business continuity plan applies. Which statement is correct?
Select an answer to reveal the explanation.
Short Explanation
Think of it like a house fire: the fire crew puts it out while your family finds somewhere to sleep tonight. The IRP is the fire crew dealing with the attacker; the BCP keeps the business running in the meantime. The trap is thinking a cyberattack can't trigger continuity plans.
Full Explanation
The incident response plan and the business continuity plan have different scopes that often overlap in time. The IRP governs detecting, analyzing, containing and eradicating the threat and coordinating response decisions. The BCP governs keeping critical business processes running at an acceptable level during disruption, whatever its cause, for example through manual order handling or alternate channels. A multi-day ransomware outage of a critical process triggers both, coordinated through agreed handoffs. Saying only the IRP applies because the cause is a security incident misunderstands continuity planning, which is cause-agnostic; disruption, not its source, triggers the BCP. Saying only the BCP applies because the outage is long ignores that the attacker still has to be contained and removed; there is no duration limit on incident response. Saying neither applies until disaster recovery is invoked reverses the logic: the DRP restores technology and usually operates alongside both plans, and waiting for restoration before acting leaves the business and the threat unmanaged. Exam caveat: the plans should define who coordinates when several are active, often a crisis management team. Operational check: confirm the IRP's severity criteria include a defined trigger for notifying the BCP owner.