[FINAL] services should be designed with proactive security event discovery in mind. D) Capabilities to minimise the impacts of a cyber security incident on the delivery of essential services including the restoration of those services where necessary. D.1 Response and Recovery Planning: ● ● There are well-defined and tested incident management processes in place, that aim to ensure continuity of essential services in the event of system or service failure. Mitigation activities designed to contain or limit the impact of compromise are also in place. D.2 Lessons Learned: ● When an incident occurs, steps must be taken to understand its root causes and ensure appropriate remediating action is taken. Explanation Response and Recovery Planning:​ ​Incidents will invariably happen. When they do organisations should be prepared to deal with them, and as far as possible, have mechanisms in place that minimise the impact on the essential service. The particular mechanisms required should be determined as part of the organisation's overall risk management approach. Examples might include things such as DDoS protection, protected power supply, critical system redundancy, rate-limiting access to data or service commands, critical data backup or manual failover processes. Improvements:​ ​If an incident does occur it is important the organisation learns lessons as to why it happened and where appropriate takes steps to prevent the same issue from recurring. The aim should be to address the root cause or seek to identify systemic problems rather than solely fix a very narrow issue. For example to address the organisations overall patch management process rather than to just apply a specific missing patch. Page 35