Which of the following is the MOST important element in developing an effective business continuity plan (BCP)?

Question

Options

• ABusiness impact analysis (BIA)
• BPublished incident response plan
• CPeriodic penetration testing
• DCurrent disaster recovery plan (DRP)

• A
  90% (45)
• B
  4% (2)
• C
  2% (1)
• D
  4% (2)

Explanation

A Business Impact Analysis (BIA) is the foundation of any effective BCP because it identifies critical business functions, quantifies the impact of disruptions, and establishes recovery time objectives (RTOs) and recovery point objectives (RPOs) - without this data, the entire plan lacks direction and priority.

Why the distractors are wrong:

• B (Incident Response Plan): Incident response addresses how to react to security events, not how to keep the business running - it's a narrower, security-focused document.
• C (Penetration testing): Pen testing is a proactive security control, not a continuity planning element; it doesn't inform what to recover or in what order.
• D (Disaster Recovery Plan): The DRP is actually a component of the BCP (focused on IT systems), not the other way around - the BCP is the broader parent plan, and the DRP is downstream of the BIA.

Memory tip: Think of BIA as the blueprint - you can't build (the BCP) or furnish (the DRP) a house until you know what rooms you need and which ones matter most. BIA answers "what hurts and how much?" - everything else is built on that answer.

No community discussion yet for this question.