A CISA is evaluating an organization's business continuity plan (BCP). The CISA finds that while the BCP documents extensive recovery procedures for IT systems, it lacks a Business Impact Analysis (BIA) that identifies critical business functions, their dependencies, and acceptable downtime. What is the MOST significant implication of this omission?
- AThe BCP may not prioritize recovery efforts according to actual business needs.
- BThe organization may fail to comply with regulatory requirements for data retention.
- CIT recovery teams may lack the technical skills to execute system recovery.
- DThe cost of maintaining the BCP will be unnecessarily high.
Show answer & explanationAnswer & explanation
Correct answer: A. The BCP may not prioritize recovery efforts according to actual business needs.
A BIA is foundational to a BCP because it identifies the most critical business functions, their dependencies, and defines acceptable recovery time objectives (RTOs) and recovery point objectives (RPOs). Without a BIA, recovery procedures, however detailed, cannot be appropriately prioritized or aligned with the organization's actual business continuity requirements, leading to misdirected efforts and potential business failure.
Why the other options are wrong
- B. Data retention is a separate issue from recovery prioritization, though both are part of overall business resilience.
- C. Technical skills are an execution issue, while the BIA defines the strategic direction for recovery.
- D. Cost is a financial concern, but the primary risk is the failure of the BCP to effectively support business continuity.
Business Impact Analysis (BIA)
A Business Impact Analysis (BIA) identifies and evaluates the potential effects of business disruptions, determining critical business functions, their dependencies, and establishing Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
- Foundation for BCP and DRP.
- Identifies critical business functions.
- Defines RTOs and RPOs based on business needs.
Memory trick: Without a map, even the fastest car can't reach the right destination.