CCAK · Question #78
What should be an organization's control audit schedule of a cloud service provider's business continuity plan and operational resilience policy?
The correct answer is A. Annual. Industry best practices and frameworks such as ISO 22301 (Business Continuity Management) and NIST guidelines recommend that business continuity plans and operational resilience policies be reviewed and audited on an annual basis. This cadence balances thoroughness with…
Question
What should be an organization's control audit schedule of a cloud service provider's business continuity plan and operational resilience policy?
Options
- AAnnual
- BQuarterly
- CMonthly
- DSemi-annual
How the community answered
(54 responses)- A87% (47)
- B2% (1)
- C4% (2)
- D7% (4)
Explanation
Industry best practices and frameworks such as ISO 22301 (Business Continuity Management) and NIST guidelines recommend that business continuity plans and operational resilience policies be reviewed and audited on an annual basis. This cadence balances thoroughness with practicality - BCP/DRP documents typically reflect stable long-term organizational structures that don't require quarterly or monthly review. Annual audits ensure the plan remains current without creating audit fatigue. More frequent schedules (monthly/quarterly) are reserved for higher-volatility operational controls.
Topics
Community Discussion
No community discussion yet for this question.