Certified Information Security Manager (CISM)Incident ManagementMedium
A CISO is reviewing the organization's business continuity plan (BCP) and identifies that while critical IT systems have robust recovery strategies, there is a significant gap in addressing the availability of specialized personnel required to operate these systems in a disaster. Which of the following is the MOST effective strategy to mitigate this risk?
- AOutsource critical IT operations to a third-party managed service provider.
- BImplement a comprehensive cross-training program for IT staff on all critical systems.
- CDevelop detailed runbooks and standard operating procedures (SOPs) for all recovery tasks.
- DEstablish a formal succession planning program for key technical roles.
Show answer & explanationAnswer & explanation
Correct answer: D. Establish a formal succession planning program for key technical roles.
Succession planning ensures that there are designated and trained individuals ready to step into critical roles, directly addressing the availability of specialized personnel in a disaster scenario. While other options contribute to resilience, succession planning specifically tackles the human resource continuity aspect.
Why the other options are wrong
- A. Outsourcing can transfer some operational risk but introduces new dependencies and may not be feasible or desirable for all critical IT operations, nor does it directly ensure internal specialized personnel availability.
- B. Cross-training enhances general resilience but may not fully address the loss of highly specialized individuals, as it focuses on broader skill sets rather than specific role replacement.
- C. Detailed runbooks and SOPs are valuable for operational continuity but do not guarantee the availability of personnel with the necessary expertise to execute them in a disaster.
Succession Planning (BCP)
Succession planning in Business Continuity Planning (BCP) is the process of identifying and developing internal people with the potential to fill key business leadership positions in the event of unforeseen vacancies.
- Ensures continuity of critical roles.
- Reduces impact of loss of key personnel.
- Essential for human resource resilience in BCP.
Memory trick: Key people's shoes must be fillable, quickly.