This domain focuses on identifying, analyzing, mitigating, and recovering from risks and incidents in an enterprise environment. It ensures business continuity, minimizes downtime, and protects assets from threats and vulnerabilities.
Perform qualitative and quantitative risk assessments. Understand threats, vulnerabilities, and impacts to prioritize mitigation efforts.
Develop plans to maintain operations during disruptive events, ensuring minimal downtime and continuity of critical services.
Design and implement recovery strategies for systems, applications, and data to restore operations after a disaster.
Build and execute incident response plans (IRPs) using frameworks like NIST SP 800-61. Focus on detection, containment, eradication, and recovery.
Integrate internal and external threat feeds into your security operations to proactively identify and mitigate risks.
Understand GDPR, HIPAA, SOX, and PCI-DSS responsibilities related to incident reporting and data protection.
Master risk evaluation methods such as Risk Matrix, Risk Register, Asset Valuation, Exposure Factor, Single Loss Expectancy (SLE), and Annual Loss Expectancy (ALE).
Design strategies including RTORecovery Time Objective: how quickly a system must be restored after disruption. and RPORecovery Point Objective: acceptable amount of data loss measured in time..
Prepare for detection, containment, eradication, recovery, and lessons learned phases. Maintain chain of custody during evidence collection.
Utilize STIX/TAXII protocols and integrate feeds from ISACs, commercial vendors, and open-source communities.
Ready to continue your CASP+ journey? Next: Research, Analysis and Assessment →