CSL CSL Business Continuity & Disaster Recovery Planning 2 — Questions and Answers
Question 1: Which international standard provides the primary framework for Business Continuity Management Systems (BCMS)?
- ISO/IEC 27001
- ISO 22301 (Correct answer)
- NIST SP 800-53
- COBIT 2019
Correct answer: ISO 22301
ISO 22301 is the international standard specifically for Business Continuity Management Systems, specifying requirements for planning, establishing, implementing, and improving a BCMS.
Question 2: What is 'Maximum Tolerable Downtime' (MTD) in business continuity planning?
- The time it takes to complete a full disaster recovery failover
- The total length of time a business process can be unavailable before causing irreversible harm (Correct answer)
- The maximum number of hours the IT team can work during a crisis
- The time between the last backup and the occurrence of a disaster
Correct answer: The total length of time a business process can be unavailable before causing irreversible harm
MTD (also called MTPD — Maximum Tolerable Period of Disruption) defines the threshold beyond which an organization cannot survive the loss of a function, and sets the upper boundary for RTO.
Question 3: A warm site disaster recovery option is best characterized as:
- A facility with hardware and connectivity ready but requiring data restoration before use (Correct answer)
- A fully mirrored production environment with live data replication
- An empty building with power and network connections only
- A cloud-based virtual environment activated on demand
Correct answer: A facility with hardware and connectivity ready but requiring data restoration before use
A warm site has pre-installed hardware and network infrastructure but requires data to be restored from backups before operations can resume, balancing cost and recovery speed.
Question 4: In the context of BCP, what does 'crisis communications' primarily address?
- Encrypting all internal communications during a security incident
- Timely, accurate, and coordinated information sharing with employees, customers, media, and regulators during a disruption (Correct answer)
- Establishing a VPN for remote employee access during disasters
- Documenting all post-incident technical findings for legal purposes
Correct answer: Timely, accurate, and coordinated information sharing with employees, customers, media, and regulators during a disruption
Crisis communications ensures stakeholders receive consistent, timely, and accurate information during a disruption, protecting organizational reputation and maintaining trust.
Question 5: What is the correct sequence for developing a Business Continuity Plan?
- Test plan → Conduct BIA → Develop recovery strategies → Train staff
- Conduct BIA → Develop recovery strategies → Document the BCP → Test and maintain the plan (Correct answer)
- Document the BCP → Conduct BIA → Test plan → Develop strategies
- Train staff → Conduct BIA → Document the BCP → Test plan
Correct answer: Conduct BIA → Develop recovery strategies → Document the BCP → Test and maintain the plan
The correct BCP development sequence begins with a BIA to understand impacts and priorities, followed by strategy development, plan documentation, and ongoing testing and maintenance.
Question 6: Which metric helps determine how frequently an organization should perform data backups?
- RTO (Recovery Time Objective)
- MTD (Maximum Tolerable Downtime)
- RPO (Recovery Point Objective) (Correct answer)
- MTTF (Mean Time to Failure)
Correct answer: RPO (Recovery Point Objective)
RPO defines the maximum acceptable data loss period, which directly dictates the required backup frequency — a 1-hour RPO demands at minimum hourly backups.
Question 7: A cybersecurity leader is reviewing the organization's DR plan and finds that the RTO for a critical system is 4 hours but the MTD is 2 hours. What action is required?
- No action needed — RTO and MTD do not need to be aligned
- Reduce the RPO to match the MTD
- Improve the recovery strategy so the RTO is less than or equal to the MTD (Correct answer)
- Extend the MTD to accommodate the current RTO
Correct answer: Improve the recovery strategy so the RTO is less than or equal to the MTD
The RTO must always be less than or equal to the MTD; if RTO exceeds MTD, the organization will exceed its tolerance threshold before recovery is complete, requiring an improved recovery strategy.
CSL CSL Business Continuity & Disaster Recovery Planning 2
Which international standard provides the primary framework for Business Continuity Management Systems (BCMS)?