Page 177 - Courses

Exploring Corrective Controls

Business Continuity Plan (BCP) — The specific plan, by business unit, that addresses how critical
business processes would be performed in the event of a natural/human-invoked disaster or
technology failure. The BCP takes into consideration the needs of people, processes, and
technology.

Business Resilience Management — Comprehensive and standardized management of all
processes that identify and mitigate risks that threaten organizations.

Organizational Resilience — The need for businesses to address how to sustain operations in the
event of an outage or failure of internal processes and the external supply chain.

Disaster Recovery Plan (DRP) — The IT side of continuity planning that provides direction on how
to recover technology based on dependencies and system criticality.

Incident Management — Management of technology-related exceptions ranging from user error to
data exfiltration. Incident management should consider the prevention, identification, and response
to any variation from acceptable behavior by a system or person.

Incident Response Plan (IRP) — How the organization performs incident response, starting with
reporting and recording the incident; continuing to triage, analysis, containment, and eradication;
describing roles and responsibilities and communication expectations; and stating how to perform a
post-mortem root cause analysis.

Incident Response Playbook — An Incident Response Playbook is designed to provide a step-by-
step walk-through for most probable and impactful cyber threats to your organization. The
Playbook will ensure that certain steps of the Incident Response Plan are documented appropriately
and serve as a reminder if certain steps in the IRP are not followed.

Maximum Tolerable Outage (MTO) — The maximum amount of time a system can be down before
the organization risks serious fines, penalties, or impacts to operations.

Recovery Point Objective (RPO) — The amount of data, if any, that the organization can lose
without regulatory or reputational impact.

Recovery Time Objective (RTO) — The amount of time, if any, that a system can be unavailable
without regulatory or reputational impact.

Resiliency — Foundation of continuity and mitigation against any form of economic disruption at a
business, regional, national, or global level.

Restore — The process of making backup data available to the business.

Copyright © 2021 by The Institute of Internal Auditors, Inc. All rights reserved.