Question

During a contained malware incident, the response team discovers the infection has spread to the systems supporting the organization's primary customer-facing platform, and full restoration is now expected to exceed the documented maximum tolerable downtime. As the information security manager, what is the MOST appropriate next action?

Accepted Answer

Invoke the business continuity plan and escalate to crisis management, activating alternate processing arrangements

Answer

Continue technical eradication and recovery efforts without changing the response structure, since the incident team is already engaged

Answer

Reclassify the incident to a lower severity to avoid unnecessary stakeholder alarm while recovery proceeds

Answer

Wait until the maximum tolerable downtime is actually breached before triggering any continuity measures