Which component deals with restoring services and operations to normal after an incident?

Which component deals with restoring services and operations to normal after an incident?

• A. Recovery
• B. Detection
• C. Analysis
• D. Containment

Answer: (A)

Restoring services and operations to normal after an incident is the recovery phase of incident response. This phase focuses on bringing systems back online, repairing or rebuilding affected components, restoring data from backups, and validating that everything functions correctly so business processes can resume. It follows containment (which limits damage) and eradication (which removes the threat), while detection identifies the incident and analysis determines its scope and impact. The recovery effort is specifically about returning to normal operations safely and efficiently, making it the best fit.

Restoring services and operations to normal after an incident is the recovery phase of incident response. This phase focuses on bringing systems back online, repairing or rebuilding affected components, restoring data from backups, and validating that everything functions correctly so business processes can resume. It follows containment (which limits damage) and eradication (which removes the threat), while detection identifies the incident and analysis determines its scope and impact. The recovery effort is specifically about returning to normal operations safely and efficiently, making it the best fit.