HCISPP · Question #261
Drag and Drop Question During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an…
The correct answer is Risk Assessment; Business Impact Analysis; Mitigation Strategy Development; BC/DR Plan Development; Training, Testing & Auditing; Plan Maintenance. The question requires correctly ordering the standard phases of a Business Continuity/Disaster Recovery (BC/DR) plan into a sequential and cyclical flow diagram.
Question
Drag and Drop Question During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-house. The college collecting this data is fully aware of the regulations for Health Insurance Portability and Accountability Act (HIPAA) and is fully compliant. What is the best approach for the CISO? Below are the common phases to creating a Business Continuity/Disaster Recovery (BC/DR) plan. Drag the remaining BC\DR phases to the appropriate corresponding location. Answer:
Exhibit
Answer Area
Drag items
Correct arrangement
- Risk Assessment
- Business Impact Analysis
- Mitigation Strategy Development
- BC/DR Plan Development
- Training, Testing & Auditing
- Plan Maintenance
Explanation
The question requires correctly ordering the standard phases of a Business Continuity/Disaster Recovery (BC/DR) plan into a sequential and cyclical flow diagram.
Approach. The correct interaction is to drag and drop the BC/DR phases into the five empty boxes in the following order, based on standard BC/DR methodologies and the provided solution image:
- Risk Assessment: This is the foundational first step, identifying potential threats and vulnerabilities to the organization.
- Business Impact Analysis (BIA): Following risk assessment, the BIA determines the potential impact of disruptions on critical business functions and assets.
- Mitigation Strategy Development: Based on the identified risks and their potential impacts, strategies are developed to reduce the likelihood or severity of disruptions.
- BC/DR Plan Development: The actual plan document is created, detailing procedures, roles, and responsibilities for responding to and recovering from incidents.
- Training, Testing & Auditing: The developed plan must be disseminated, personnel trained, the plan tested for effectiveness, and audited for compliance and improvements. The loop-back arrow from this stage to 'Risk Assessment' signifies that the results of testing and auditing feed into a continuous improvement cycle, which inherently covers 'Plan Maintenance'.
Therefore, 'Plan Maintenance' is not placed in a discrete box within this linear flow but is rather an overarching, continuous activity represented by the entire cyclical process, where the output of testing leads back to re-evaluating risks and updating the plan.
Common mistakes.
- common_mistake. Common mistakes include misordering the sequential steps, such as placing Business Impact Analysis before Risk Assessment, or BC/DR Plan Development before Mitigation Strategy Development. Another common error would be attempting to place 'Plan Maintenance' into one of the five boxes. While Plan Maintenance is a critical aspect of BC/DR, it is often depicted as an ongoing activity or a continuous feedback loop that encompasses the entire cycle of reassessment, rather than a single discrete step in the initial plan creation and validation process. The provided solution image explicitly shows 'Plan Maintenance' outside the sequential boxes, indicating it's not meant to be dropped into one of them in this specific question's context.
Concept tested. The core concept being tested is the understanding of the standard phases and cyclical nature of Business Continuity/Disaster Recovery (BC/DR) planning and implementation.
Topics
Community Discussion
No community discussion yet for this question.