nerdexam
Isaca

CISM · Question #217

Which of the following is MOST important to consider when developing a disaster recovery plan (DRP)?

The correct answer is C. Business impact analysis (BIA). A Business Impact Analysis (BIA) is the foundation of any DRP because it identifies which business functions are critical, quantifies the impact of disruptions, and establishes recovery time objectives (RTOs) and recovery point objectives (RPOs) - without this data, you cannot…

Submitted by rachelw· Apr 18, 2026Information Security Program Development and Management

Question

Which of the following is MOST important to consider when developing a disaster recovery plan (DRP)?

Options

  • ARisk management plan
  • BBusiness continuity plan (BCP)
  • CBusiness impact analysis (BIA)
  • DCost-benefit analysis

How the community answered

(18 responses)
  • A
    11% (2)
  • B
    6% (1)
  • C
    83% (15)

Explanation

A Business Impact Analysis (BIA) is the foundation of any DRP because it identifies which business functions are critical, quantifies the impact of disruptions, and establishes recovery time objectives (RTOs) and recovery point objectives (RPOs) - without this data, you cannot build a meaningful recovery plan.

  • A (Risk Management Plan) is broader and focuses on identifying/mitigating risks before they occur; a DRP deals with response after a disaster, making the BIA a more direct input.
  • B (Business Continuity Plan) is actually the output or parent framework that a DRP fits within - the BCP encompasses the DRP, not the other way around.
  • D (Cost-benefit analysis) informs budgeting decisions but cannot define what to recover or in what order - that prioritization comes from the BIA.

Memory tip: Think of BIA as the "triage nurse" - before any recovery action, you must know which systems are life-critical and how long the business can survive without them. No triage = no effective recovery plan.

Topics

#Disaster Recovery Plan (DRP)#Business Impact Analysis (BIA)#Business Continuity#Planning

Community Discussion

No community discussion yet for this question.

Full CISM Practice