Which of the following BEST facilitates recovery of data lost as a result of a cybersecurity incident?

Offsite data backups are the most direct and effective control for facilitating the recovery of data lost in a cybersecurity incident. Storing backups in a geographically separate and logically isolated location protects them from the same event that impacts the primary operational environment, such as a ransomware attack that encrypts or deletes local files and connected backups. This ensures that a clean, uncompromised version of the data is available for restoration, which is the fundamental requirement for data recovery and a cornerstone of business continuity and disaster recovery.

A. Removable storage media: This describes a type of media, not a complete recovery strategy. If stored onsite, it could be destroyed or compromised by the same incident.

B. Disaster recovery plan (DRP): A DRP is the documented set of procedures for recovery. The plan itself does not contain the data; it relies on the existence of viable backups.

D. Encrypted data drives: Encryption is a confidentiality control that protects data from unauthorized access. It does not prevent data from being deleted, corrupted, or made unavailable.

---

1. ISACA

CISM Review Manual

15th Edition. Domain 4: Information Security Incident Management. Knowledge Statement K4.6

"Knowledge of the technological resources (e.g.

communication systems

security event information and management systems) and escalation processes required to manage information security incidents." This knowledge area implicitly covers the necessity of recovery resources

of which offsite backups are paramount for data restoration. The manual emphasizes that recovery from incidents like data corruption or ransomware depends on having viable

isolated backups.

2. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

"Contingency Planning Guide for Federal Information Systems." Section 4.2.2

"Backup Methods

" states

"Backup media and/or duplicated hard-copy information should be stored in a secure

environmentally controlled offsite facility..." This highlights the official best practice of using offsite storage to protect against site-wide disasters and security incidents.

3. Purdue University

"Information Security Policy (VII.B.2)." In the section on "Contingency Planning

" the policy mandates the creation and maintenance of backup and recovery capabilities. It specifies

"Backup media must be stored in a physically secure

off-campus location

" directly supporting the principle that offsite storage is critical for effective data recovery. (Available via Purdue University's IT policies documentation).