Access to information and information assets can be partially or completely interrupted by natural disasters, accidents, equipment failures, or malicious activities. As Mary Lou Emmons explains, appropriate business continuity planning — planning for the unexpected — must be undertaken to protect the availability of critical information resources and continuity of operations.

Indeed the Information Security & Privacy Program focuses primarily on applying safeguards, though most are preventive against unintended & unauthorized use & exposure. If & when prevention fails, IU must be able to detect & respond to incidents. What's more, the process of preparing for, detecting, responding to, and tracking such incidents directly impacts the reduction of frequency & severity.