10.1 Business Continuity and Emergency Response

Why business continuity sits in Domain 4

Domain 4 of the ISC2 Systems Security Certified Practitioner (SSCP) exam — Incident Response and Recovery — is weighted at 14% under the outline effective 1 October 2025. Knowledge areas 4.1 and 4.2 taught you how to handle a security incident and how to preserve evidence. Knowledge area 4.3 — Understand and support business continuity plan (BCP) and disaster recovery plan (DRP) — is what you do when ransomware, a flood, a pandemic, or a failed generator actually stops the mission.

The outline's first 4.3 bullet is Emergency response plans and procedures (information system contingency, pandemic, natural disaster, crisis management). The SSCP is not asked to author a 200-page binder. You are asked to know which plan keeps the business running, which plan restores information technology, which numbers come from a Business Impact Analysis (BIA), and what you do in the first hour of a fire, a city-wide flood, or a flu wave that empties the payroll office.

Incident response (contain, eradicate, recover) handles the security event. BCP and DRP handle continued operations whether the cause was malware, weather, or a backhoe. Ransomware is often both: 4.1 to isolate and eradicate, 4.3 to keep contractors paid and to restore systems inside the downtime the business can survive. Do not skip occupant emergency because you are eager to image a disk. Do not skip paper workarounds because you are proud of backup software.

BCP keeps the business running; DRP restores IT

This split is the highest-yield 4.3 fact on the Computerized Adaptive Testing (CAT) exam.

A warehouse can keep shipping with printed pick lists and a paper log while the warehouse management system is down — that is BCP. Rebuilding that application at a warm site from Saturday's backup is DRP. Getting everyone out of the smoke-filled data closet is emergency response. Exam stems mix the three on purpose. If people are still in a burning building, you do not start a restore.

National Institute of Standards and Technology (NIST) SP 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems, is the commonly cited U.S. model. You do not need to recite every publication number. You do need to match the event to the document.

A pandemic that keeps payroll clerks at home is a BCP and crisis-management problem. A failed storage array with the building intact is closer to ISCP and DRP. A tornado warning is OEP first, then BCP and DRP if the site is actually lost.

The BIA drives critical processes

Nothing in 4.3 is cost-effective without a Business Impact Analysis (BIA). The BIA is the study that names:

1. Which mission and business processes exist (payroll, order-to-cash, electronic health record charting, claims adjudication, warehouse scanning).
2. Which information systems, vendors, and facilities those processes depend on — including identity, Domain Name System (DNS), payment networks, and power.
3. What happens financially, legally, operationally, and to safety if the process stops, scored over time (1 hour, 8 hours, 24 hours, 72 hours, a week).
4. Maximum Tolerable Downtime (MTD) for each process: how long the organization can survive without it before the harm is unacceptable.
5. Recovery priorities so IT does not invent its own ranking on the night of the outage.

The BIA is not a technical restore procedure. It is the business conversation that later becomes Restore Time Objective (RTO) and Restore Point Objective (RPO) in restoration planning. If payroll cannot be down more than 24 hours because contractors will not load trucks without pay, that is a BIA finding. The SSCP then designs a DRP that can actually meet it.

A BIA that lists every server as critical is useless. Rank processes, then map systems. The exam loves the trap of restoring a low-impact intranet wiki first because it lives on the same hypervisor and is easy, while payroll, the electronic health record, or the warehouse scanners wait.

Scenario. You are the systems administrator for a regional logistics firm. A transformer fire takes headquarters offline on a Thursday afternoon. Leadership wants all systems restored. The BIA, last updated after a tabletop, ranks: (1) warehouse scanning and shipping labels, MTD 8 hours; (2) payroll for the Friday contractor cycle, MTD 24 hours; (3) the marketing website, MTD one week. You do not start with the public website because it is in the same cluster. You activate BCP workarounds for shipping (handhelds on cellular, paper fallback) and you start the DRP for the warehouse application. That is BIA-driven operations.

Update the BIA when the business changes. A new same-day shipping promise, a new clinic, or a payroll vendor switch changes MTD. An SSCP who treats a three-year-old spreadsheet as scripture will restore the wrong thing.

Emergency response plans and procedures

The outline names four examples. Treat them as different triggers that still share a command structure, a communications path, and a written procedure.

Information system contingency

An information system contingency plan (NIST's ISCP) is the per-system playbook: how this payroll application, this domain controller, or this file server is recovered. It includes roles, notification, detailed recovery steps, dependencies, and how you validate that the system is usable — not merely that the virtual machine pinged. The enterprise DRP says fail the datacenter to Site B. The ISCP says restore PAYROLL-APP from the immutable copy, re-point DNS, run the post-restore checklist, and have payroll clerks process a test cycle before you call it successful.

Contingency also covers degraded operation: fail a cluster node, switch to a read-only replica, or run a manual process while IT rebuilds. The BCP may keep paying people from a spreadsheet while the ISCP restores the application. Write the degraded mode down. Staff who have never posted payroll on paper will not invent a clean process at 22:00.

Pandemic

A pandemic (or any long-running workforce-loss event) is a people-and-access problem more than a restore-the-array problem. Facilities may be intact. The BCP addresses:

• Remote access capacity: virtual private network (VPN) licenses, multi-factor authentication (MFA) tokens, split-tunnel policy, help-desk surge, virtual desktop capacity.
• Who can run payroll, claims, or clinic intake from home, and on which managed devices.
• Cross-training so one sick team does not halt a critical process.
• Vendors and contract staff who cannot enter the building.
• Communications when email is overloaded or rumor outruns facts.

Pandemic planning that only says everyone VPN, without checking whether the identity provider, the virtual desktop farm, and the call center can absorb that load, fails on Monday morning. A hot site in another city does not help if the people who run payroll cannot work from anywhere. Cross-train the backup payroll clerk before influenza season, not during it.

Natural disaster

Natural disasters (flood, earthquake, hurricane, wildfire, ice storm, tornado) damage facilities, power, and communications. Emergency response starts with life safety (OEP): evacuate, account for people, do not send administrators back for backup tapes through floodwater. After that, the BCP relocates processes and the DRP activates an alternate processing site.

Geographic diversity matters. A DR site 8 km away on the same river floodplain is not an alternate. Reciprocal agreements and cloud regions fail if both sites share the same utility or the same fiber cut. The SSCP's job in planning is to notice shared-fate dependencies — power, telecom, flood zone, the same identity tenant — not to become a meteorologist. After the event, do not declare the building safe because you want the SAN. Facilities and safety own re-entry.

Crisis management

Crisis management is the command-and-control overlay: who is in charge, who speaks, how often leadership gets a status, when you declare a disaster, and when you return to normal. It sits above BCP and DRP. A crisis can be ransomware, a fatal accident, a product failure, or a natural disaster.

Crisis communications belong here: a named spokesperson, holding statements, an employee channel that does not depend on the failed building's phone switch, and no engineer posting generator photos that reveal the remaining site. Technical staff feed verified facts (what is down, what is not yet known, when the next update is). Public relations and legal own external words — the same discipline knowledge area 4.1 taught for incidents.

Declare a disaster using written BIA criteria (MTD approaching, facility unusable, identity provider gone), not because a director is loud. Undeclared disasters delay vendor DR contracts and insurance notification. Premature declarations burn the alternate site and staff stamina. Record the declaration time; RTO clocks start from disruption, but vendors and staff still need a clear activate signal.

How to attack a CAT item on 10.1

1. If people are in danger, occupant emergency is first.
2. If the question is how the process continues (shipping, payroll, clinic intake), look for BCP workarounds and people.
3. If the question is how the application or datacenter comes back, look for DRP or ISCP.
4. If restore order is the fight, the BIA wins over administrator convenience.
5. If the workforce is gone and the datacenter is fine, think pandemic / BCP, not only hot-site failover.
6. Reject options that treat cyber insurance, a marketing site, or an untested reciprocal handshake as a substitute for a plan.