Certified Information Security Manager (CISM)Incident ManagementMedium
A healthcare organization is developing its Disaster Recovery Plan (DRP). The CISO is debating the inclusion of a comprehensive communication plan with external stakeholders (e.g., regulators, media, patients). What is the MOST compelling reason to integrate such a communication plan into the DRP?
- AIt reduces the overall cost of disaster recovery operations.
- BIt minimizes the impact on system availability during recovery.
- CIt streamlines internal decision-making during a disaster.
- DIt ensures compliance with legal and regulatory reporting requirements.
Show answer & explanationAnswer & explanation
Correct answer: D. It ensures compliance with legal and regulatory reporting requirements.
For healthcare organizations, legal and regulatory requirements (like HIPAA) often mandate specific timelines and methods for notifying affected individuals, regulators, and sometimes the media in the event of a data breach or system outage affecting patient data. A comprehensive external communication plan ensures these obligations are met, mitigating legal and reputational risks.
Why the other options are wrong
- A. A communication plan, while essential, does not directly reduce the operational cost of recovery infrastructure or services.
- B. Communication does not directly impact system availability; that is addressed by technical recovery strategies (RTO, RPO).
- C. External communication primarily addresses external parties, not internal decision-making, which is handled by internal communication plans.
DRP Communication Plan
A component of the Disaster Recovery Plan that outlines how and when to communicate with internal and external stakeholders during and after a disaster.
- Addresses legal, regulatory, and ethical obligations.
- Manages reputation and maintains trust.
- Specifies communication channels, content, and responsible parties.
Memory trick: Speak clearly, or face legal woes.