【CISSP】Chapter 3 Business Continuity Planning

Exam Essentials

1. Understand the four steps of the business continuity planning process. Business continuity planning involves four distinct phases: project scope and planning, business impact analysis, continuity planning, and approval and implementation. Each task contributes to the overall goal of ensuring that business operations continue uninterrupted in the face of an emergency.

2. Describe how to perform the business organization analysis. In the business organization analysis, the individuals responsible for leading the BCP process determine which departments and individuals have a stake in the business continuity plan. This analysis serves as the foundation for BCP team selection and, after validation by the BCP team, is used to guide the next stages of BCP development.

3. List the necessary members of the business continuity planning team. The BCP team should contain, at a minimum, representatives from each of the operational and support departments; technical experts from the IT department; physical and IT security personnel with BCP skills; legal representatives familiar with corporate legal, regulatory, and contractual responsibilities; and representatives from senior management. Additional team members depend on the structure and nature of the organization.

4. Know the legal and regulatory requirements that face business continuity planners. Business leaders must exercise due diligence to ensure that shareholders’ interests are protected in the event disaster strikes. Some industries are also subject to federal, state, and local regulations that mandate specific BCP procedures. Many businesses also have contractual obligations to their clients that they must meet before, during, and after a disaster.

5. Explain the steps of the business impact analysis process. The five stages of the business impact analysis process are the identification of priorities, risk identification, likelihood assessment, impact analysis, and resource prioritization.

6. Describe the process used to develop a continuity strategy. During the strategy development phase, the BCP team determines which risks they will mitigate. In the provisions and processes phase, the team designs mechanisms and procedures that will mitigate identified risks. The plan must then be approved by senior management and implemented. Personnel must also receive training on their roles in the BCP process.

7. Explain the importance of comprehensively documenting an organization’s business continuity plan. Committing the plan to writing provides the organization with a written record of the procedures to follow when disaster strikes. It prevents the “it’s in my head” syndrome and ensures the orderly progress of events in an emergency.

Written Lab

1. Why is it essential to include legal representatives on your business continuity planning team?

2. What is wrong with taking an informal approach to business continuity planning?

3. What is the difference between quantitative and qualitative assessment?

4. What critical components should you include in your business continuity training plan?

5. What are the four main steps of the business continuity planning process?

Review Questions

1. James was recently asked by his organization’s CIO to lead a core team of four experts through a business continuity planning process for his organization. What is the first step that this core team should undertake?

A. BCP team selection                                    B. Business organization analysis

C. Resource requirements analysis                D. Legal and regulatory assessment

2. Tracy is preparing for her organization’s annual business continuity exercise and encounters resistance from some managers who don’t see the exercise as important and feel that it is a waste of resources. She has already told the managers that it will only take half a day for their employees to participate. What argument could Tracy make to best address these concerns?

A. Exercise is required by policy.

B. The exercise is already scheduled and canceling it would be difficult.

C. Exercise is crucial to ensuring that the organization is prepared for emergencies.

D. The exercise will not be very time-consuming.

3. The board of directors of Clashmore Circuits conducts an annual review of the business continuity planning process to ensure that adequate measures are in place to minimize the effect of a disaster on the organization’s continued viability. What obligation are they satisfied by this review?

A. Corporate responsibility                          B. Disaster requirement

C. Due diligence                                          D. Going concern responsibility

4. Darcy is leading the BCP effort for her organization and is currently in the project scope and planning phase. What should she expect will be the major resource consumed by the BCP process during this phase?

A. Hardware              B. Software                  C. Processing time               D. Personnel

5. Ryan is assisting with his organization’s annual business impact analysis effort. He’s been asked to assign quantitative values to assets as part of the priority identification exercise. What unit of measure should he use?

A. Monetary               B. Utility                        C. Importance                      D. Time

6. Renee is reporting the results of her organization’s BIA to senior leaders. They express frustration at all of the detail, and one of them says, “Look, we just need to know how much we should expect these risks to cost us each year.” What measure could Renee provide to best answer this question?

A. ARO                      B. SLE                           C. ALE                                 D. EF

7. Jake is conducting a business impact analysis for his organization. As part of the process, he asks leaders from different units to provide input on how long the enterprise resource planning (ERP) system could be unavailable without causing irreparable harm to the organization. What measure is he seeking to determine?

A. SLE                        B. EF                              C. MTD                             D. ARO

8. You are concerned about the risk that an avalanche poses to your $3 million shipping facility. Based on expert opinion, you determine that there is a 5 percent chance that an avalanche will occur each year. Experts advise you that an avalanche would completely destroy your building and require you to rebuild on the same land. Ninety percent of the $3 million value of the facility is attributed to the building, and 10 percent is attributed to the land itself. What is the single loss expectancy (SLE) of your shipping facility to avalanches?

A. $3 million               B. $2,700,000                 C. $270,000                      D. $135,000

9. Referring to the scenario in question 8, what is the annualized loss expectancy?

A. $3 million               B. $2,700,000                 C. $270,000                        D. $135,000

10. You are concerned about the risk that a hurricane poses to your corporate headquarters in South Florida. The building itself is valued at $15 million. After consulting with the National Weather Service, you determine that there is a 10 percent likelihood that a hurricane will strike over the course of a year. You hired a team of architects and engineers, who determined that the average hurricane would destroy approximately 50 percent of the building. What is the annualized loss expectancy (ALE)?

A. $750,000                B. $1.5 million                 C. $7.5 million                     D. $15 million

11. Chris is completing the risk acceptance documentation for his organization’s business continuity plan. Which one of the following items is Chris least likely to include in this documentation?

A. Listing of risks deemed acceptable

B. Listing of future events that might warrant reconsideration of risk acceptance decisions

C. Risk mitigation controls put in place to address acceptable risks

D. Rationale for determining that risks were acceptable

12. Brian is developing continuity plan provisions and processes for his organization. What resource should he protect as the highest priority in those plans?

A. Physical plant               B. Infrastructure               C. Financial                D. People

13. Ricky is conducting the quantitative portion of his organization’s business impact analysis. Which one of the following concerns is least suitable for quantitative measurement during this assessment?

A. Loss of a plant     B. Damage to a vehicle           C. Negative publicity          D. Power outage

14. Lighter than Air Industries expects that it would lose $10 million if a tornado struck its aircraft operations facility. It expects that a tornado might strike the facility once every 100 years. What is the single loss expectancy for this scenario?

A. 0.01                     B. $10 million                            C. $100,000                         D. 0.10

15. Referring to the scenario in question 14, what is the annualized loss expectancy?

A. 0.01                     B. $10 million                            C. $100,000                          D. 0.10

16. In which business continuity planning task would you actually design procedures and mechanisms to mitigate risks deemed unacceptable by the BCP team?

A. Strategy development                                  B. Business impact analysis

C. Provisions and processes                            D. Resource prioritization

17. Matt is supervising the installation of redundant communications links in response to a finding during his organization’s BIA. What type of mitigation provision is Matt overseeing?

A. Hardening systems                                       B. Defining systems

C. Reducing systems                                        D. Alternative systems

18. Helen is working on her organization’s resilience plans, and her manager asks her whether the organization has sufficient technical controls in place to recover operations after a disruption. What type of plan would address the technical controls associated with alternate processing facilities, backups, and fault tolerance?

A. Business continuity plan                               B. Business impact analysis

C. Disaster recovery plan                                  D. Vulnerability assessment

19. Darren is concerned about the risk of a serious power outage affecting his organization’s data center. He consults the organization’s business impact analysis and determines that the ARO of a power outage is 20 percent. He notes that the assessment took place three years ago and no power outage has occurred. What ARO should he use in this year’s assessment, assuming that none of the circumstances underlying the analysis have changed?

A. 20 percent                  B. 50 percent                 C. 75 percent             D. 100 percent

20. Of the individuals listed, who would provide the best endorsement for a business continuity plan’s statement of importance?

A. Vice president of business operations                B. Chief information officer

C. Chief executive officer                                        D. Business continuity manager