In an incident response plan, which phase focuses on restoring services and operations to normal after containment and eradication?

• A. Preparation
• B. Containment
• C. Recovery
• D. Lessons Learned

Answer: (C)

The recovery phase is about bringing services and operations back to normal after the threat has been contained and eradicated. Once the immediate danger is removed, the focus shifts to restoring IT services, bringing affected systems back online, and replenishing data from verified-clean backups. This includes validating that systems are functioning correctly, performing tests to confirm that normal operations can resume without issues, and coordinating with business units to reinstate workflows and user access. It also involves monitoring for any signs of residual problems and applying necessary hardening or patches to prevent recurrence.

Other phases set up and prevent or remove the threat, but they don’t focus on the long, steady process of returning everything to its normal state. Preparation is about readiness before anything happens, containment limits the spread during an incident, eradication removes the threat, and lessons learned looks at what happened to improve future responses.