Assume degraded trust
A system may be online but not yet trusted for normal business use.
Alternate methods
Continuity strategies can identify temporary ways to perform priority work while investigation and recovery continue.
Separate response tracks
Cyber incident response, legal/privacy obligations, communications and business continuity should coordinate without collapsing into one team.
Recovery evidence
Restoring a system is not the same as validating that business data and dependent processes are reliable.
Business continuity is organization-specific. Recovery priorities, legal duties, safety requirements, contracts, insurance terms and technical recovery methods should be validated by the responsible people in the organization.