Has your organization defined criteria for selecting recovery actions during incident response, and are these criteria followed when responding to security incidents?

Recovery action selection is being evaluated here: whether you have defined criteria for choosing recovery actions during incident response and apply them consistently when incidents occur. Having predefined criteria helps ensure that recovery efforts are systematic, prioritized correctly, and aligned with business needs rather than being ad hoc or inconsistent.

Evidence could include a documented incident response plan with a section on recovery action selection criteria, decision matrices that map incident types to appropriate recovery actions, or post-incident reports showing how recovery decisions were made based on established criteria.