This edition concentrates on the threats posed to operations security by outside activities. Domain 8 addresses business continuity planning and disaster recovery planning. There is considerable confusion related to the terminology used in this domain, but essentially it boils down to the planning of specific, coordinated actions to avoid or mitigate the effects of disruptions to normal business information processing functions. This edition contains chapters discussing issues related to both business continuity planning and disaster recovery planning. Domain 9 addresses law, investigations, and ethics.
Law involves the legal and regulatory issues facing an information security function.
Investigation consists of guidelines and principles necessary to successfully investigate security incidents and preserve the integrity of evidence. Ethics deals with a knowledge of the difference between right and wrong and the willingness to do the right thing. Domain 10 addresses physical security. Physical security involves the provision of a safe environment for information processing activities, with a focus on preventing unauthorized physical and technical access to computing equipment. The chapter included in this edition is concerned with threats and facility requirements.