IT Service Management and Systems Audit
Which of the following is an appropriate way to draw up a business continuity plan (BCP)?
- ASince every business activity is indispensable, aim to recover all business activities and systems with the same priority and within the same time
- BWriting up the plan and distributing it to everyone is enough, so costly exercises and reviews of the plan are not needed
- CAnalyze the impact on the business to determine the critical activities to be continued or recovered first and the acceptable downtime, set recovery targets and procedures for the systems that support them, and keep exercising and reviewing the plan
Show answer and explanation
Answer: C. Analyze the impact on the business to determine the critical activities to be continued or recovered first and the acceptable downtime, set recovery targets and procedures for the systems that support them, and keep exercising and reviewing the plan
A BCP is a plan for continuing critical business activities, or resuming them quickly, even when a disaster or large-scale failure occurs. First, the impact on the business is analyzed (business impact analysis) to determine the critical activities and their acceptable downtime, and targets such as the recovery time objective (RTO) and recovery point objective (RPO) are set for the systems that support them. Exercises confirm whether the plan actually works, and it keeps being reviewed as the organization and its systems change. This ongoing cycle of drawing up, exercising and reviewing the plan is called business continuity management (BCM).
- A. Trying to recover everything with the same priority spreads limited resources thin and delays the resumption of critical activities.
- B. Without exercises, it is unknown whether the plan actually works, and it cannot keep up with changes in the organization.
- C. Correct. Impact analysis determines the critical activities and targets, and exercises and reviews continue.
Continue: 9 more IT Service Management and Systems Audit questions