After an incident, the IT team declares that the order management system has been recovered and wants to close the recovery phase. What should happen before the system returns to normal operation?
Select an answer to reveal the explanation.
Short Explanation
IT can tell you the engine starts, but only the driver knows if the car actually gets them where they need to go. The business owner is the one who confirms the system works for the business. Don't let a green light on a dashboard stand in for that.
Full Explanation
Technical recovery shows that infrastructure and applications are running; it does not prove that business processes work correctly or that data is complete and accurate after restoration. The business owner, who is accountable for the process and its information, should validate the recovered system using agreed checks, such as reconciling transactions, testing key workflows and confirming data from the recovery point, before it is returned to normal operation. That confirms the business can rely on it and identifies any data that must be re-entered or reconciled. An IT infrastructure health check is a necessary technical step but confirms only that components function; IT declaring closure on its own bypasses business acceptance. A vulnerability scan supports security assurance and may identify weaknesses to address, yet a clean scan does not confirm functional or data integrity, and closing the incident on that basis skips business validation and the post-incident review. External auditor sign-off is not a standard prerequisite for returning a system to operation and confuses independent assurance with operational acceptance by the owner. Exam caveat: validation criteria should be defined in recovery plans in advance so acceptance is fast and consistent. Operational check: confirm a signed business acceptance record exists before recovery is closed.