Frequently asked questions

Can one IT generalist run this process?

One person can coordinate it, but decision authority, specialist review and ongoing operations still need named owners. NIST's small-business guide provides a useful organizing framework without implying that every role can be performed by one employee.

Are the time estimates industry averages?

No; they are editorial allowances for planning and should be replaced with estimates from your own owners. The NIST response guidance supplies a conceptual foundation, not the hours or delivery timetable used here.

What is the cheapest sensible first step?

Collect the contract, inventory and coverage evidence you already have before buying another product. CISA's customer guidance supports clarifying service responsibilities and access before relying on outsourced operations.

Can a restore exercise be replaced by a provider brochure?

No; the brochure establishes advertised functionality, while a buyer-controlled exercise establishes what works in the actual environment. Treat a recovery vendor's product description as an input to the test plan, not the result.

Should we perform our own penetration test in production?

Only perform testing that is authorized, competently scoped and safe for the affected systems. The range of specialist services shown by Bishop Fox illustrates why a narrowly defined, professionally delivered engagement may be more suitable than an improvised test.