A small earthquake caused a gas pipe to rupture, and the ensuing explosion and fire devastated the end of their building which housed their "back office" operations - the server room! Significantly damaged, if not totally destroyed, were their Computer Aided Design and Manufacturing (CADAM) server system and its file servers, along with the server that hosted all of their accounting, customer relationship management, payroll and Human Resources information systems.

One option you discuss with them would be a rehearsal - a table-top or "meeting-style" walk-through of a script for a major event. What is the purpose of the rehearsal? And how would OmniFab executives know that the rehearsal had been a success

Coming into work the Monday morning the week after the post-rehearsal review meeting, OmniFab's systems administrators detect that a major malware infestation has struck their systems. Their CADAM systems, their front and back office business systems (such as accounting, customer relationship management, etc.), all were affected. Following their CSIRT procedures, they shut down Internet access, isolated systems from each other, and began the process of identifying each corrupted or infected system. But it's not clear how much of the underlying databases were infected, or how much of them remain trustworthy at this point. They do have some backup copies of data and software, and some of the OmniFab managers just want to reload the systems and get back into operation quickly. What would you advise them to do, and in what order should they take these steps?