Certified Incident Handler (CIH) Practice Ecam

Which of the following actions is NOT part of the incident recovery strategy?

1. Developing emergency communication plans

2. Training staff for incident response

3. Creating new profit-centered business processes

4. Conducting a post-incident review

The correct answer is: Creating new profit-centered business processes

The reason "creating new profit-centered business processes" is the correct choice for the action that is NOT part of the incident recovery strategy lies in the purpose of incident recovery itself. Incident recovery strategies are primarily focused on restoring operations, ensuring business continuity, and mitigating the effects of the incident to facilitate a return to normalcy. Actions such as developing emergency communication plans and training staff for incident response directly support this goal by ensuring that everyone knows how to respond during an incident and can communicate effectively. Conducting a post-incident review is essential for understanding what went wrong and improving future responses, which is also integral to recovering effectively from an incident. In contrast, creating new profit-centered business processes does not align with immediate recovery actions; instead, it focuses on revenue generation and potential long-term strategic changes, which are typically addressed after the immediate recovery and response efforts have been completed.