BCM BCM Program Governance & Compliance 1 — Questions and Answers
Question 1: Which international standard provides the most widely recognized framework for Business Continuity Management Systems?
- ISO 22301 (Correct answer)
- ISO 9001
- ISO 27001
- NIST SP 800-34
Correct answer: ISO 22301
ISO 22301 is the international standard specifically designed for Business Continuity Management Systems.
Question 2: What is the primary role of a BCM governance committee?
- Drafting recovery procedures
- Providing oversight, policy direction, and accountability for BCM activities (Correct answer)
- Conducting BIA interviews
- Managing IT disaster recovery
Correct answer: Providing oversight, policy direction, and accountability for BCM activities
A BCM governance committee provides strategic oversight, sets policy direction, and ensures organizational accountability for the BCM program.
Question 3: Which regulatory requirement most commonly drives US financial institutions to maintain formal BCM programs?
- SOX Section 404
- FFIEC IT Examination Handbooks (Correct answer)
- HIPAA Security Rule
- PCI-DSS Requirement 12
Correct answer: FFIEC IT Examination Handbooks
The FFIEC IT Examination Handbooks provide comprehensive BCM guidance and compliance expectations for US financial institutions.
Question 4: What does a BCM policy statement primarily define?
- Detailed recovery procedures
- Organizational commitment, scope, objectives, and roles for the BCM program (Correct answer)
- System backup schedules
- Vendor contact lists
Correct answer: Organizational commitment, scope, objectives, and roles for the BCM program
A BCM policy statement defines the organization's commitment, scope, objectives, and high-level roles and responsibilities for the program.
Question 5: In the context of BCM compliance audits, what is a 'gap analysis'?
- A review of network vulnerabilities
- A comparison of current BCM practices against a target standard to identify deficiencies (Correct answer)
- An assessment of employee training completion rates
- A financial impact calculation
Correct answer: A comparison of current BCM practices against a target standard to identify deficiencies
A gap analysis compares the organization's current BCM state against a target standard or framework to identify areas requiring improvement.
Question 6: Which concept ensures that BCM responsibilities are clearly assigned and no single person controls all aspects of a critical BCM process?
- Redundancy
- Segregation of duties (Correct answer)
- Chain of command
- Span of control
Correct answer: Segregation of duties
Segregation of duties ensures that no single individual controls all aspects of a critical process, reducing risk and ensuring accountability.
BCM BCM Program Governance & Compliance 1
Which international standard provides the most widely recognized framework for Business Continuity Management Systems?