Which component focuses on restoring normal operations and ensuring services are available after an incident?

• A. Detection
• B. Containment
• C. Eradication
• D. Recovery

Answer: (D)

Restoring normal operations and ensuring services are available after an incident is the focus of the recovery phase. After the threat is contained and eradicated, the recovery process aims to bring affected systems back online, validate that applications and services function correctly, and resume business processes. This involves restoring data from backups, repairing or rebuilding components, reapplying configurations, and conducting tests and ongoing monitoring to confirm stability and availability. The goal is to return to a known-good state and maintain business continuity. The other steps focus earlier on detection (finding the incident), containment (limiting impact), and eradication (removing the threat).