Certified Information Security Manager (CISM)Incident ManagementHard
A CISO is reviewing the organization's business continuity plan (BCP) and identifies a critical single point of failure: a proprietary manufacturing system that lacks redundancy and has a very long lead time for replacement parts. To mitigate this risk, which of the following strategies is MOST effective in enhancing the system's resilience within the BCP context?
- AEstablishing a mutual aid agreement with a competitor for system sharing.
- BImplementing a hot standby site for all IT infrastructure.
- CDeveloping manual workarounds and alternative production methods.
- DPurchasing a large inventory of spare parts for the proprietary system.
Show answer & explanationAnswer & explanation
Correct answer: C. Developing manual workarounds and alternative production methods.
Given the lack of redundancy and long lead time for replacement parts, establishing manual workarounds and alternative production methods is the most effective BCP strategy. This addresses the business process continuity directly, ensuring operations can continue (albeit perhaps at a reduced capacity) even if the system fails, which is the core goal of BCP.
Why the other options are wrong
- A. A mutual aid agreement with a competitor is generally impractical and risky for proprietary systems due to IP and competitive concerns.
- B. A hot standby site addresses IT infrastructure, not the specific proprietary manufacturing system's lack of redundancy or parts.
- D. Purchasing spare parts helps with recovery but doesn't provide immediate business continuity during a failure if the system itself lacks redundancy and requires significant repair time.
BCP Workarounds
Business Continuity Plan (BCP) workarounds are pre-defined alternative manual or temporary processes that allow critical business functions to continue operating when automated systems or primary infrastructure are unavailable.
- Crucial for systems with high RTOs or single points of failure.
- Focus on maintaining business function, not just IT recovery.
- Requires thorough documentation and staff training.
Memory trick: When the bridge is out, find another path.