Which statement best differentiates incident response from disaster recovery in organizational cybersecurity planning?

• A. Incident response detects, contains, and removes threats; disaster recovery restores business operations after a major disruption
• B. Incident response is only about data backups; disaster recovery deals with incident detection
• C. They are the same process
• D. Incident response focuses on physical security while disaster recovery focuses on software

Answer: (A)

The key idea is that incident response and disaster recovery serve different purposes in cybersecurity planning: incident response is about handling a security event as it happens, while disaster recovery is about restoring the organization’s operations after a major disruption.

Incident response focuses on the immediate threat: detecting the incident, containing it to prevent further damage, eradicating the attacker or malware, and recovering affected systems while preserving evidence for analysis. It’s the active, short-term response to the incident itself.

Disaster recovery, on the other hand, is about getting the business back up and running after a major disruption, which may be a cyberattack but also could be a natural disaster. It emphasizes resuming critical services, recovering IT infrastructure, and restoring data and processes, often with backups or alternate sites in play.

So the best choice captures this distinction: incident response handles detection, containment, and removal of threats; disaster recovery focuses on restoring business operations after the disruption. The other options mix up the roles—backups are a disaster recovery aspect, incident detection is central to incident response, and the two are not the same process.