Has your organization established and documented criteria for determining when incident recovery processes should be initiated based on incident characteristics?

This question assesses whether your organization has defined clear thresholds or decision points for activating recovery procedures following a security incident. These criteria should consider factors like incident severity, systems affected, data compromise, operational impact, and recovery resource requirements. Having predefined recovery criteria ensures consistent decision-making during incidents and prevents delays in recovery actions when needed. Evidence could include a documented incident response plan with a specific section on recovery criteria, decision matrices that map incident types/severity to recovery actions, or runbooks that outline the conditions triggering recovery processes.