ISC2 CISSP (Certified Information Systems Security Professional)Security OperationsMedium
A large pharmaceutical company is conducting a business impact analysis (BIA) as part of its business continuity planning. During this process, they are evaluating the financial, operational, and reputational consequences of a prolonged outage of their research and development (R&D) laboratory systems. What is the primary purpose of this activity within the BIA?
- ATo assign personnel responsibilities for emergency response.
- BTo develop specific recovery procedures for the R&D systems.
- CTo create a detailed inventory of all R&D software and hardware assets.
- DTo identify the Maximum Tolerable Downtime (MTD) for the R&D function.
Show answer & explanationAnswer & explanation
Correct answer: D. To identify the Maximum Tolerable Downtime (MTD) for the R&D function.
The primary purpose of evaluating the consequences (financial, operational, reputational) of prolonged outages during a BIA is to determine the Maximum Tolerable Downtime (MTD) for each critical business function. This MTD then guides the establishment of appropriate Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
Why the other options are wrong
- A. Assigning personnel responsibilities is part of incident response and recovery planning, which follows the BIA.
- B. Developing recovery procedures occurs after the BIA, using the MTD/RTO/RPO as inputs.
- C. Creating an asset inventory is part of broader asset management or risk assessment, not the primary purpose of analyzing outage consequences in a BIA.
Business Impact Analysis (BIA)
A BIA is a systematic process to evaluate the potential effects of an interruption to critical business operations. It identifies critical functions, their dependencies, and the financial, operational, and reputational impacts of various outage scenarios.
- Identifies critical business functions and processes.
- Determines the impact of disruptions over time.
- Establishes Maximum Tolerable Downtime (MTD).
- Forms the foundation for recovery strategies and RTO/RPO.
Memory trick: BIA: What hurts most, how bad, how long?