Continuity, Recovery, and Response Drill
Key Takeaways
Business continuity (BC) and disaster recovery (DR) are in Domain 2 under subdomain 2.2.
Incident response (IR) and the Incident Response Plan are in Domain 5 under subdomain 5.3.
Choose the response that matches the part of the event the scenario describes.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomains 2.2 and 5.3, checked 2026-10-22.
Three Parts, Two Domains
Business continuity and disaster recovery are named in subdomain 2.2 under Security Governance. Incident response is named in subdomain 5.3 under Security Operations and Incident Response. A scenario may involve all three, so separate the parts: keeping operations going is continuity, restoring technology is disaster recovery, and handling the incident under the plan is incident response.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 2.2 and 5.3, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 2.2: Business Continuity (BC)
- 2.2: Disaster Recovery (DR)
- 5.3: Data handling policy implementing Incident Response Plan (IRP)
- 5.3: Incident Response (IR) exercises (e.g., testing, tabletop)
Common Traps
A common trap is treating business continuity and disaster recovery as the same plan. Continuity keeps the business running; disaster recovery restores technology. Match the answer to the part the scenario describes.
A scenario asks how to restore a failed server after an incident. Which subtopic fits the restoration part?
Disaster Recovery (DR), subdomain 2.2
Phishing awareness, subdomain 2.3, which covers how staff recognize and report suspicious messages
Access reviews, subdomain 3.1, which covers how user accounts are reviewed during the lifecycle
Network segmentation, subdomain 4.2, which covers firewall zones and micro-segmentation designs
Working the Drill
Take a single event through three checkpoints. At the continuity checkpoint, ask whether essential operations keep running. At the recovery checkpoint, ask what technology must be restored and in what state. At the response checkpoint, ask whether the Incident Response Plan was followed and the actions recorded. Name the checkpoint each candidate answer addresses before choosing.
Sections you finish are checked off in the contents.