Has your organization assessed and documented how incident recovery activities might impact normal business operations?

This question evaluates whether your organization has analyzed how cybersecurity incident recovery procedures could disrupt day-to-day operations. For example, restoring systems from backups might require temporary service outages, isolating infected systems could impact connected business processes, or redirecting staff to incident response might delay other critical functions. Evidence could include a business impact analysis document, incident response playbooks that include operational impact assessments, or recovery time objective (RTO) documentation that accounts for operational disruptions during recovery activities.