ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITMedium
A CISA is evaluating an organization's business continuity plan (BCP). The CISA notes that while the BCP details recovery strategies for IT systems and data, it lacks specific procedures for communicating with key external stakeholders (e.g., customers, regulators, media) during a prolonged disruption. Which of the following is the MOST significant gap in the BCP?
- ALack of employee awareness training for BCP procedures.
- BRisk of reputational damage and legal non-compliance.
- CInability to restore critical IT infrastructure within RTOs.
- DFailure to identify all critical business functions.
Show answer & explanationAnswer & explanation
Correct answer: B. Risk of reputational damage and legal non-compliance.
A comprehensive BCP must address not only internal recovery but also external communication. Failure to have a plan for communicating with customers, regulators, and the media during a crisis can lead to severe reputational damage, loss of customer trust, and potential regulatory fines for non-compliance, which are critical business impacts beyond just IT recovery.
Why the other options are wrong
- A. Employee awareness is important, but the absence of external communication procedures poses a broader and potentially more damaging risk to the organization's standing and compliance.
- C. The question states IT recovery strategies are detailed, so this is not the gap identified.
- D. The scenario focuses on external communication, not the initial identification of critical functions, though that is also important.
BCP External Communication
The component of a Business Continuity Plan (BCP) that outlines strategies, procedures, and responsibilities for communicating with external parties (e.g., customers, media, regulators, suppliers) during and after a business disruption.
- Crucial for managing public perception and maintaining trust.
- Helps ensure regulatory compliance.
- Minimizes financial and reputational losses.
Memory trick: BCP Comms: Speak Out, Not Just Recover In.