11. Operational Resilience, Incident and Crisis Governance

Introduction and Context

Cybersecurity risk management is often discussed in terms of prevention: secure architecture, access controls, threat intelligence, vulnerability management, and compliance. Prevention, however, cannot eliminate every failure. A determined attacker, a software defect, an unavailable supplier, human error, or a natural hazard may still disrupt critical services. The decisive question is therefore not whether an organization will experience disruption, but whether it can continue essential operations, make sound decisions under pressure, communicate responsibly, and recover without repeating the same weaknesses.

Operational resilience is the organizational capability to anticipate, withstand, respond to, adapt to, and recover from disruptive events. It is broader than information security and broader than business continuity. Incident response normally addresses the management of a security event; business continuity protects the continued delivery of important services; disaster recovery restores technology and facilities; and crisis management coordinates strategic decisions when consequences exceed routine operational authority. These disciplines overlap, but they are not interchangeable.

This chapter examines how these capabilities can be integrated into a coherent governance system. It focuses on escalation, decision rights, communications, recovery objectives, exercises, post-incident learning, and the managerial consequences of major ransomware and data-breach events. The central proposition is that resilience is not merely a collection of plans. It is a governed capability supported by clear priorities, prepared people, reliable information, tested processes, and accountable leadership.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Distinguish incident response, business continuity, disaster recovery, crisis management, and operational resilience.

2. Design an integrated governance model with escalation thresholds and decision rights.

3. Apply recovery time objectives, recovery point objectives, maximum tolerable periods of disruption, and minimum business continuity objectives.

4. Develop practical approaches to crisis communications, stakeholder coordination, and regulatory notification.

5. Plan and evaluate exercises, including tabletop, functional, technical, and full-scale exercises.

6. Analyse ransomware and breach scenarios from technical, operational, legal, ethical, and strategic perspectives.

7. Conduct a post-incident review that produces measurable control improvement rather than blame or documentation alone.

From Incident Handling to Operational Resilience

An event is an observable occurrence in a system or environment. An event becomes a security incident when it threatens or violates confidentiality, integrity, or availability, or when it breaches security policy. A major incident is one whose impact, urgency, uncertainty, or external consequences require coordinated management beyond ordinary operational procedures.

Incident response is the structured process used to prepare for, detect, analyse, contain, eradicate, and recover from incidents. Its immediate concern is controlling the event and preserving evidence. Business continuity management concentrates on maintaining or restoring prioritized business activities at an acceptable level during disruption. Disaster recovery is the technology- and facility-oriented subset of continuity concerned with restoring systems, data, infrastructure, and dependencies. Crisis management addresses situations in which strategic decisions, executive leadership, public confidence, legal exposure, or organizational legitimacy are at stake.

Operational resilience connects these disciplines by beginning with important business services rather than isolated assets. The organization asks: Which services must continue? What people, processes, technology, facilities, information, and third parties support them? What level of disruption is tolerable? What alternatives exist if normal resources fail? This service-oriented view prevents a common mistake: restoring a server successfully while the business service remains unavailable because identity services, telecommunications, suppliers, or skilled personnel are still disrupted.

Resilience has both preventive and adaptive dimensions. Preventive controls reduce the likelihood or impact of disruption. Adaptive capabilities allow the organization to operate differently when assumptions fail. For example, immutable backups are preventive against permanent data loss, while a rehearsed manual order process is adaptive when enterprise applications are unavailable. Mature organizations invest in both.

A Governance Architecture for Incidents and Crises

Governance determines who has authority, what information is required, how decisions are recorded, and when an issue moves from one management level to another. Without governance, incident response can become technically competent but organizationally confused. Security teams may isolate systems without understanding operational consequences; executives may make public commitments without reliable facts; legal and privacy teams may receive information too late to meet notification obligations.

A useful structure contains four connected levels:

• Operational response: Analysts, administrators, engineers, and service owners detect, verify, contain, and restore affected components.
• Tactical incident management: An incident manager coordinates workstreams, prioritizes containment and recovery, manages dependencies, and maintains the incident record.
• Crisis management: A senior group decides on business priorities, risk acceptance, public posture, customer actions, workforce measures, and exceptional expenditure.
• Strategic oversight: The board or governing body oversees material risk, executive accountability, regulatory exposure, and long-term remediation.

These levels should not imply that every incident is escalated to the board. Escalation should be based on defined criteria such as impact on critical services, duration, spread across business units, suspected data compromise, safety implications, inability to contain the event, material financial loss, significant media interest, or involvement of a strategic supplier. Thresholds should be objective enough to trigger action but flexible enough to accommodate uncertainty.

A decision-rights matrix, often expressed through a RACI model, clarifies who is responsible for performing work, accountable for outcomes, consulted before decisions, and informed afterward. For example, the chief information security officer may be accountable for security containment, the chief operating officer for continuity of essential services, the general counsel for legal strategy, the privacy officer for personal-data obligations, and the chief executive for major risk acceptance and external positioning. Responsibilities must be assigned before the crisis; attempting to establish authority during an attack creates delay and conflict.

The incident commander coordinates the response but does not automatically own every decision. Technical specialists determine how to isolate a compromised endpoint, while business owners decide whether a service can be taken offline. Executives decide whether to authorize extraordinary spending, suspend operations, engage law enforcement, or accept a residual risk. Separating coordination from decision ownership reduces both micromanagement and unauthorized action.

Recovery Objectives and Priorities

Recovery planning requires explicit measures of time, data, and service performance. The recovery time objective (RTO) is the target time within which a process or system should be restored after disruption. The recovery point objective (RPO) defines the maximum acceptable period of data loss, measured backward from the disruption. An RPO of fifteen minutes implies that recovery arrangements should normally lose no more than fifteen minutes of transactions, although the objective is not a guarantee.

The maximum tolerable period of disruption (MTPD) is the longest period an activity can be unavailable before the consequences become unacceptable. The RTO must normally be shorter than the MTPD, allowing time for degraded operation, stabilization, and decision-making. A minimum business continuity objective (MBCO) describes the minimum level of service that must be maintained during disruption. A hospital appointment system, for example, may not need full functionality immediately, but it may require the ability to identify patients, record urgent appointments, and access critical clinical information.

These objectives should be established through business impact analysis rather than copied from technical standards. Business impact analysis considers financial loss, safety, legal duties, customer harm, operational dependencies, reputation, and time-sensitive data. It should also identify tolerable degradation. A service may be restored in read-only mode, with manual processing, reduced geographic coverage, or restricted customer functionality.

Dependencies are especially important. Recovery of an application may depend on identity management, network connectivity, encryption keys, cloud control planes, clean administrator accounts, suppliers, and trained staff. Plans that specify only system restoration times are incomplete. Organizations should map dependencies and identify points where a common failure could interrupt several supposedly independent services.

The Incident and Crisis Lifecycle

Preparation begins with policies, inventories, contact lists, playbooks, logging, backups, contracts, training, and exercises. Preparation also includes pre-approved legal, communications, forensic, and technology providers. Retainers are useful only if access, authority, confidentiality, and payment arrangements have been tested.

Detection and analysis establish what happened, what is affected, and how confident the organization is in its assessment. Early information is incomplete, so incident records should distinguish facts, assumptions, hypotheses, and unknowns. An effective situation report states the confidence level of key findings rather than presenting speculation as certainty.

Containment aims to limit spread and protect critical services. Short-term actions may include isolating hosts, disabling accounts, blocking traffic, or suspending integrations. Long-term containment may involve rebuilding systems, rotating credentials, segmenting networks, or moving services to alternate environments. Containment decisions must consider evidence preservation and business consequences. A rushed shutdown may destroy volatile evidence or disrupt safety-critical operations, while delayed isolation may allow an attacker to expand access.

Eradication removes malicious persistence and addresses the exploited weakness. It may require rebuilding systems rather than merely deleting malware. Recovery returns services to operation in a controlled manner. Systems should be restored from trusted sources, monitored closely, and validated by service owners. Recovery is not complete when a server is online; it is complete when the business service is functioning at an acceptable level and residual risks are understood.

Crisis management runs alongside these technical stages when consequences become strategic. The crisis team maintains a common operating picture, establishes meeting cadence, assigns decision owners, approves communications, and reviews changes in impact. Crisis meetings should be decision-oriented. Each decision record should identify the issue, available options, chosen action, owner, deadline, assumptions, and review point.

Communications as a Control Activity

Communication is not an administrative afterthought. It influences trust, legal exposure, operational coordination, employee behaviour, and attacker incentives. A communication strategy should identify audiences, information needs, channels, approval authority, timing, and fallback methods if corporate systems are unavailable.

Internal audiences need practical instructions: what systems to avoid, how to report suspicious activity, where to work, how to authenticate, and how services will be prioritized. Customers need to know whether they are affected, what action is required, and how the organization is reducing harm. Regulators and law enforcement may require factual information, timelines, evidence, and points of contact. Suppliers need coordinated instructions, particularly where shared infrastructure is involved. Investors and the board require a balanced account of impact, uncertainty, financial exposure, and remediation.

Crisis messages should be accurate, proportionate, and updated as facts change. Organizations should avoid both premature reassurance and unsupported alarm. It is acceptable to state that an investigation is continuing, provided the organization explains what is known, what remains uncertain, and when the next update will occur. Communications should not disclose sensitive technical details that would increase risk, obstruct investigation, or expose affected individuals unnecessarily.

Privacy and data-protection requirements may impose notification deadlines and content requirements. These obligations vary by jurisdiction and by the nature of the data and organization. Legal advice should therefore be integrated early, but legal review should not become an excuse for withholding useful protective information from affected parties.

Exercises and Assurance

Plans are hypotheses about how an organization will behave under stress. Exercises convert those hypotheses into evidence. A discussion-based tabletop exercise tests assumptions, roles, escalation, and decisions. A functional exercise tests coordination among teams using simulated injects. A technical exercise tests detection, containment, failover, restoration, and evidence handling. A full-scale exercise combines operational and managerial activity and may involve external partners.

A well-designed exercise has defined objectives, a realistic scenario, controlled injects, observers, decision logs, and an after-action process. The purpose is not to reward participants for performing a script. It is to expose ambiguity, dependency failure, unrealistic recovery targets, unavailable contacts, and conflicts between security and operational priorities. Exercises should include inconvenient conditions such as unavailable executives, compromised communication channels, incomplete information, supplier failure, or simultaneous public interest.

Findings should be ranked by risk and converted into action owners, deadlines, funding requirements, and validation methods. Repeating the same exercise without closing previous findings creates the appearance of assurance without resilience. Metrics may include time to detect, time to contain, time to restore critical services, percentage of critical systems covered by tested backups, percentage of key roles with trained alternates, and age of overdue remediation actions. Metrics must be interpreted carefully: a shorter restoration time is not beneficial if evidence is destroyed or unsafe systems are returned to production.

Post-Incident Review and Organizational Learning

A post-incident review is a governance mechanism for learning, not a search for a convenient individual to blame. It should examine the chain of conditions that allowed the incident to occur and increase in impact. Questions include whether warnings were visible, whether controls operated as designed, whether alerts were investigated, whether risk decisions were documented, and whether incentives encouraged unsafe behaviour.

The review should reconstruct a timeline from reliable records, assess the effectiveness of controls, identify contributing factors, and compare actual performance with stated objectives. Contributing factors may include excessive privileges, unsupported systems, weak segmentation, inadequate monitoring, supplier concentration, ambiguous ownership, insufficient staffing, or delayed executive escalation.

Recommendations should be specific and testable. “Improve awareness” is weak; “implement phishing-resistant authentication for privileged users, with coverage measured monthly and exceptions approved by the risk owner” is stronger. Each action should have an accountable owner, target date, priority, dependencies, and evidence of completion. The board or risk committee should receive material findings and track whether remediation reduces risk rather than merely producing new documents.

Illustrative Case: Ransomware at Northbridge Manufacturing

Background

Northbridge Manufacturing is a fictional multinational producer of industrial components. Its production scheduling, enterprise resource planning, identity services, and supplier portals are hosted across corporate data centres and a cloud environment. The company has tested backups, but its last enterprise-wide recovery exercise occurred two years earlier. The security team has a formal incident response plan, while business continuity plans are maintained separately by operations.

Situation

On a Monday morning, production supervisors report that shared files and scheduling applications are unavailable. Security monitoring detects unusual encryption activity and disabled endpoint protection on several servers. An administrator account appears to have been used from an unusual location. The incident team initially isolates affected servers, but the isolation also interrupts authentication required by two production sites. Within hours, a ransom demand is discovered. Evidence suggests that the attacker accessed the environment several days earlier, but the extent of data theft is unknown.

Analysis

The incident is escalated to the crisis management team because critical production services are affected, privileged credentials may be compromised, personal and commercial data may have been exfiltrated, and recovery time is uncertain. The incident commander establishes technical, business continuity, legal/privacy, communications, and supplier workstreams. The chief operating officer prioritizes safe production lines and customer-critical orders. The chief information security officer authorizes credential containment and forensic preservation. The general counsel coordinates notification analysis and law-enforcement engagement. The chief executive approves emergency procurement and public messaging.

The team discovers that backups for core systems are available, but one backup management account shares credentials with a compromised administrative environment. The backups are therefore treated as potentially exposed until validated. A clean recovery environment is built, privileged credentials are rotated, and restoration begins with identity services and network controls. Production sites use a pre-existing manual scheduling process, but staff require guidance and additional support.

Approach and Strategy

Northbridge rejects the assumption that paying the demand would guarantee recovery or prevent disclosure. The decision is documented as a risk-based choice after consultation with legal advisers, law enforcement, insurers, and the board. The organization prioritizes safe operations, evidence preservation, restoration from trusted backups, and transparent communication with affected stakeholders.

Technical teams segment recovery networks, rebuild critical infrastructure, validate backups, and monitor restored systems. Business teams establish a reduced production schedule based on customer criticality and safety. Communications provide employees with alternate contact methods and instruct them not to reconnect isolated devices. The privacy team investigates the possibility of data compromise and prepares notices based on verified facts rather than speculation.

Outcome

Critical production services are restored in stages. Some lower-priority administrative functions remain unavailable for longer, but the MBCO for key production is maintained through manual processes. The post-incident review finds that multi-factor authentication was incomplete for privileged access, backup administration was insufficiently segregated, and continuity plans had not been integrated with cybersecurity procedures. It also finds that the incident team lacked a pre-agreed decision rule for suspending supplier connections.

Northbridge introduces phishing-resistant authentication for privileged users, separates backup administration, expands network segmentation, tests restoration quarterly, maps critical suppliers, and creates a unified crisis playbook. The board receives a remediation dashboard linked to recovery objectives and exercise results.

Learning Points

The case demonstrates that ransomware is simultaneously a technical, operational, legal, financial, and governance crisis. Backups are valuable only when protected, recoverable, and tested. Manual workarounds are credible only when documented and rehearsed. Escalation must occur before the full impact is known, and recovery priorities must be based on important services rather than the order in which systems are discovered.

Challenges, Ethical Issues, and Common Failures

A frequent failure is treating plans as static documents. Contact details, suppliers, systems, regulations, and organizational structures change continuously. Plans must be maintained as operational capabilities and tested through exercises.

Another failure is confusing availability with resilience. Redundant infrastructure may still share identity, networking, cloud, or supplier dependencies. Similarly, an organization may restore technology while lacking staff, data quality, customer support capacity, or regulatory clearance to resume service.

Crisis decision-making is also vulnerable to cognitive bias. Leaders may minimize early warning signs, defend previous investments, or focus on visible technical damage while ignoring less visible privacy and safety consequences. Structured challenge, independent advice, and explicit uncertainty statements can improve judgement.

Ethically, organizations must balance confidentiality, public safety, privacy, business survival, and the interests of affected communities. They should not conceal material harm merely to protect reputation. Decisions about ransom payment, surveillance, employee monitoring, or disclosure of personal information require legal and ethical scrutiny. Incident responders must preserve evidence and respect authorization boundaries. Vendors and external investigators should receive only the access necessary for their roles, with confidentiality and accountability established contractually.

Technology, Automation, and Emerging Practice

Security information and event management platforms, endpoint detection tools, identity analytics, automated isolation, orchestration systems, and cloud-native monitoring can accelerate detection and containment. Automation is particularly useful for repetitive actions such as disabling known malicious sessions, enriching indicators, opening tickets, and collecting standard evidence.

Automation should not be treated as autonomous judgement in high-consequence situations. A rule that automatically disables an account may interrupt emergency operations; an artificial-intelligence system may misclassify legitimate activity or generate an inaccurate incident narrative. Human approval, audit logs, rollback procedures, model validation, and clearly defined thresholds are necessary.

Emerging resilience practice emphasizes continuous validation, identity-centric controls, cyber recovery vaults, attack-path analysis, software supply-chain assurance, and dependency mapping across cloud and managed-service providers. Threat-informed exercises increasingly simulate data theft as well as encryption, because extortion may continue even when systems are restored. Organizations are also integrating cyber resilience with enterprise risk management, operational technology safety, privacy, and third-party governance.

Best-Practice Principles

A resilient organization generally follows these principles:

1. Start with important services and their tolerable disruption, not only with technical assets.

2. Define escalation thresholds and decision rights before an incident occurs.

3. Maintain a single, reliable incident record that distinguishes facts from assumptions.

4. Protect and regularly test backups, recovery environments, alternate communications, and manual procedures.

5. Integrate security, continuity, disaster recovery, legal, privacy, communications, supplier, and executive processes.

6. Use exercises to test uncomfortable assumptions and close findings through accountable action plans.

7. Communicate early, accurately, proportionately, and consistently with affected stakeholders.

8. Treat post-incident review as a control-improvement process and measure whether risk actually declines.

9. Apply human oversight to automated containment, analytics, and artificial-intelligence-supported decisions.

10. Report material resilience risks and overdue improvements to governing bodies.

Chapter Summary

Operational resilience is the capability to continue and recover important services despite disruptive events. Incident response controls security incidents; business continuity sustains prioritized activities; disaster recovery restores technology and data; and crisis management governs strategic consequences. Their effectiveness depends on integration.

A mature governance model defines operational, tactical, crisis, and strategic responsibilities, with escalation thresholds and decision rights established in advance. Recovery planning uses MTPD, RTO, RPO, and MBCO to connect business priorities with technical capabilities. Communication, evidence preservation, exercises, dependency analysis, and post-incident review are essential controls. Ransomware and major breaches demonstrate that resilience depends not merely on prevention, but on prepared leadership, tested alternatives, protected backups, ethical judgement, and measurable learning.

Key Terms

Operational resilience: The ability to anticipate, withstand, respond to, adapt to, and recover from disruption.

Security incident: An event that threatens or violates confidentiality, integrity, availability, or security policy.

Incident response: The coordinated process of preparing for, detecting, analysing, containing, eradicating, and recovering from an incident.

Business continuity management: Management of capabilities that maintain prioritized business activities during disruption.

Disaster recovery: Restoration of technology, data, facilities, and infrastructure after disruption.

Crisis management: Strategic coordination of decisions when an event threatens major operations, stakeholders, or organizational legitimacy.

Incident commander: The person responsible for coordinating response activities and maintaining operational control.

Escalation threshold: A predefined condition requiring an incident to be transferred to a higher management level.

Recovery time objective (RTO): The target time for restoring a process or system after disruption.

Recovery point objective (RPO): The maximum acceptable period of data loss measured backward from disruption.

Maximum tolerable period of disruption (MTPD): The longest period an activity can be unavailable before consequences become unacceptable.

Minimum business continuity objective (MBCO): The minimum acceptable level of service during disruption.

Business impact analysis: A method for determining the consequences and priorities associated with disruption of activities.

Crisis communications: Planned communication with internal and external stakeholders during a high-impact event.

Tabletop exercise: A discussion-based exercise used to test plans, assumptions, roles, and decisions.

Post-incident review: A structured examination of an incident to identify causes, lessons, and control improvements.

Immutable backup: A backup protected from alteration or deletion for a defined period.

Common operating picture: A shared, current understanding of facts, impacts, uncertainties, decisions, and actions.

Decision rights: Explicit authority assigned to individuals or groups for particular decisions.

Review Questions

Short Answer Questions

1. Distinguish incident response from crisis management.

2. What is the relationship between RTO and MTPD?

3. Why should recovery planning begin with important business services?

4. State two purposes of a post-incident review.

5. What is the function of an escalation threshold?

Long Answer Questions

1. Explain how incident response, business continuity, disaster recovery, and crisis management can be integrated into one governance system.

2. Discuss the role of decision rights, escalation, and the common operating picture in major cyber incidents.

3. Explain RTO, RPO, MTPD, and MBCO and show how they influence recovery priorities.

4. Evaluate the role of exercises in testing operational resilience and organizational learning.

5. Analyse the Northbridge Manufacturing case from technical, operational, legal, ethical, and governance perspectives.

Analytical / Application Questions

1. A university loses access to identity services, learning platforms, and email after a suspected ransomware attack. Design the first six hours of escalation, decision-making, communications, and continuity actions.

2. An organization can restore its database within four hours, but its critical supplier requires three days to resume integration. Explain how dependency analysis should change its resilience strategy and recovery objectives.

3. Following a breach, executives want to state publicly that no data was stolen even though forensic analysis is incomplete. Assess the ethical, governance, legal, and communication risks and propose an alternative message.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes operational resilience from disaster recovery?

A. Operational resilience focuses only on restoring servers, while disaster recovery covers all business activities.

B. Operational resilience addresses the continued delivery and adaptation of important services, while disaster recovery primarily restores technology and data.

C. Operational resilience is used only after an incident, while disaster recovery is used only before one.

D. Operational resilience eliminates the need for incident response and business continuity planning.

Correct Answer: B. Operational resilience addresses the continued delivery and adaptation of important services, while disaster recovery primarily restores technology and data.

Question 2

An incident should generally be escalated to crisis management when which condition exists?

A. A single workstation requires a routine software update.

B. A security alert is automatically closed by a monitoring system.

C. A critical service is disrupted and executive decisions, external communication, or exceptional risk acceptance are required.

D. A user forgets a password but successfully completes the reset process.

Correct Answer: C. A critical service is disrupted and executive decisions, external communication, or exceptional risk acceptance are required.

Question 3

A system has an RTO of two hours and an RPO of fifteen minutes. What do these objectives mean?

A. The system may remain unavailable for fifteen minutes and lose two hours of data.

B. The system should be restored within two hours, with no more than approximately fifteen minutes of data loss targeted.

C. The system must be restored every fifteen minutes and retained for two hours.

D. The system may lose two hours of data but must notify users within fifteen minutes.

Correct Answer: B. The system should be restored within two hours, with no more than approximately fifteen minutes of data loss targeted.

Question 4

Why is a service-oriented recovery approach valuable during a cyber crisis?

A. It guarantees that every technical asset will be restored simultaneously.

B. It prioritizes restoration according to business importance and dependencies rather than technical convenience alone.

C. It removes the need to identify suppliers and manual workarounds.

D. It ensures that all systems are restored before any business activity resumes.

Correct Answer: B. It prioritizes restoration according to business importance and dependencies rather than technical convenience alone.

Question 5

Which action best demonstrates effective crisis communication?

A. Providing absolute reassurance before the investigation has established the facts.

B. Withholding all information until every technical uncertainty has been eliminated.

C. Explaining what is known, what remains uncertain, what stakeholders should do, and when an update will follow.

D. Publishing detailed attack indicators before checking whether disclosure could increase risk.

Correct Answer: C. Explaining what is known, what remains uncertain, what stakeholders should do, and when an update will follow.

Question 6

What is the principal purpose of a post-incident review?

A. To identify an individual who can be blamed for the incident.

B. To produce a document that replaces the need for control improvements.

C. To examine contributing conditions and create accountable, testable improvements that reduce future risk.

D. To determine whether public communication can be avoided.

Correct Answer: C. To examine contributing conditions and create accountable, testable improvements that reduce future risk.

Question 7

Which exercise is primarily discussion-based and designed to test assumptions, roles, and decisions?

A. Tabletop exercise

B. Full-scale technical recovery exercise

C. Vulnerability scan

D. Penetration test

Correct Answer: A. Tabletop exercise

Question 8

In the illustrative ransomware case, why were available backups initially treated with caution?

A. Backups are never useful in ransomware incidents.

B. The backup administration account shared credentials with a potentially compromised environment.

C. The organization had no recovery time objective.

D. The backups were stored only on paper.

Correct Answer: B. The backup administration account shared credentials with a potentially compromised environment.

Question 9

Which approach best reflects sound decision rights during a major incident?

A. The incident commander personally makes every technical, legal, operational, and public decision.

B. Authority is defined in advance, with technical, business, legal, and executive decisions assigned to appropriate owners.

C. All decisions are postponed until the board can meet in person.

D. External suppliers automatically receive authority over internal service priorities.

Correct Answer: B. Authority is defined in advance, with technical, business, legal, and executive decisions assigned to appropriate owners.

Question 10

What is a significant risk of excessive automation in high-consequence incident response?

A. Automation always prevents evidence collection.

B. Automated actions may interrupt critical operations or act on inaccurate classifications without adequate human oversight.

C. Automation makes incident records impossible to maintain.

D. Automated systems cannot perform repetitive enrichment or containment tasks.

Correct Answer: B. Automated actions may interrupt critical operations or act on inaccurate classifications without adequate human oversight.