SSCP Systems Security Certified PractitionerIncident Response and RecoveryMedium
A company is conducting its annual Business Impact Analysis (BIA). The primary goal of this analysis is to identify and prioritize critical business functions and their associated resources. Which of the following is an essential outcome of a well-performed BIA?
- AA complete inventory of all IT assets and their configurations.
- BA detailed technical plan for data backup and restoration.
- CA comprehensive list of legal and regulatory compliance requirements.
- DThe identification of Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
Show answer & explanationAnswer & explanation
Correct answer: D. The identification of Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
The BIA is crucial for identifying critical business functions and determining the impact of their disruption, which directly leads to the establishment of RTOs (how quickly they must recover) and RPOs (how much data loss is acceptable).
Why the other options are wrong
- A. An IT asset inventory is a prerequisite for a DRP, but the BIA focuses on the business impact of disruption, not just asset listing.
- B. This is an output of the DRP, which is informed by the BIA, but not the primary outcome of the BIA itself.
- C. While BIA may consider compliance, a comprehensive list of legal requirements is a broader legal and governance concern, not the essential outcome of the BIA.
Business Impact Analysis (BIA)
A systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster or emergency.
- Identifies critical business functions.
- Determines MTD, RTO, and RPO.
- Assesses financial and operational impacts of downtime.
Memory trick: BIA: 'B'usiness 'I'mpact 'A'nalysis, what hurts most, how long can it hurt?