Question

Following a resolved ransomware incident that caused a two-day outage of an order-processing system, the information security manager is preparing input for the post-incident review. Executives want to understand whether the organization's recovery capability performed as designed. Which activity will BEST demonstrate whether the incident response and recovery met business expectations?

Accepted Answer

Comparing the actual recovery time achieved against the documented recovery time objective (RTO) for the affected system

Answer

Calculating the annualized loss expectancy for future ransomware events based on the incident

Answer

Reviewing the number of endpoints that were successfully re-imaged during eradication

Answer

Assessing whether the security awareness training completion rate improved after the incident