Mixed Deck — All DRI Topics Flashcards

What is the 'stage 1 audit' in the ISO 22301 certification process and what does it assess?

Answer: A documentation review and readiness assessment conducted before the main certification audit to determine if the organization is ready to proceed to stage 2

The Stage 1 audit is a documentation review and readiness assessment conducted by the certification body to evaluate whether the BCMS is sufficiently developed and implemented to proceed to the Stage 2 on-site certification audit.

Which NIMS component establishes standardized resource management practices such as typing, credentialing, and inventorying?

Answer: Resource Management

NIMS Resource Management establishes standard mechanisms to identify, acquire, allocate, and track resources during incidents.

An organization experiences a data breach affecting customer records. Under GDPR, what is the maximum timeframe for notifying the supervisory authority?

Answer: 72 hours

GDPR Article 33 requires that a personal data breach be reported to the relevant supervisory authority within 72 hours of the organization becoming aware of it.

Which element of a crisis communication plan defines who is authorized to speak to the media on behalf of the organization?

Answer: Spokesperson policy

A spokesperson policy designates authorized individuals and alternates, ensuring that only trained, approved personnel communicate with media during a crisis.

Which of the following regulations is critical in disaster recovery?

Answer: General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is critical in disaster recovery because it imposes strict requirements for protecting personal data. Organizations must ensure that their data recovery plans comply with GDPR principles, such as data integrity, confidentiality, and the lawful processing of personal information, even after a disruptive event. Non-compliance can lead to significant fines and reputational damage.

A company decides to split operations between two active data centers so each can absorb the other's load if one fails. This strategy is called:

Answer: Active-active configuration

An active-active configuration means both sites run production workloads simultaneously and can absorb each other's traffic if one fails, with near-zero downtime.

Empathy expressed early in a crisis communication typically serves to:

Answer: Reduce outrage and build goodwill before factual information is available

Expressing empathy early signals that the organization prioritizes people over operational concerns, which reduces emotional outrage and makes audiences more receptive to subsequent factual messages.

Why is supply chain pandemic planning particularly challenging compared to other supply chain disruptions?

Answer: Simultaneous global impact means that alternative suppliers, geographies, and logistics providers are all affected at the same time

The simultaneous global impact of pandemics means that backup suppliers, alternative geographies, and substitute logistics providers are all experiencing the same conditions—the geographic and supplier diversification strategies that address most supply chain disruptions may be ineffective.

What is 'workforce resilience' in the context of pandemic planning, beyond just ensuring business continuity?

Answer: Proactively supporting the physical, mental, and financial well-being of employees to maintain their capacity to contribute during and after a health emergency

Workforce resilience encompasses proactive support for employees' physical health, mental health, and financial stability during a pandemic—recognizing that employees who are overwhelmed, anxious, or financially stressed cannot perform effectively, making workforce well-being a direct business continuity concern.

In DRI's Professional Practices, who is ultimately responsible for ensuring BC training is conducted and maintained?

Answer: Senior management, who must champion and resource the BC program

DRI's Professional Practices place ultimate responsibility for BC training on senior management, who must provide leadership, resources, and cultural support for the organization's BC program.

When conducting a BIA, what is the MOST important output for determining recovery strategy investment levels?

Answer: Prioritized business functions with their RTOs, RPOs, and MTDs

Prioritized business functions with their RTOs, RPOs, and MTDs are the critical BIA output—they directly drive decisions about how much to invest in recovery capabilities for each function and what recovery strategies are appropriate.

What is 'mean time to recover (MTTR)' and how does it differ from the Recovery Time Objective (RTO)?

Answer: RTO is the maximum acceptable recovery time set by the business; MTTR is the statistical average of actual recovery times measured over multiple events

RTO is the business requirement—the maximum acceptable recovery time. MTTR is a statistical measure of actual performance—the average time taken to recover across multiple failures or tests. MTTR must consistently beat RTO to demonstrate adequate recovery capability.

Which of the following best describes a 'single point of failure' in a BCP context?

Answer: A component whose failure would halt an entire critical process

A single point of failure is any element in a process or system that, if it fails, causes the entire critical function to stop with no fallback.

What is an 'exercise master scenario events list (MSEL)' and why is it a critical planning tool?

Answer: A chronological timeline of all planned scenario events, injects, and expected participant actions used to control exercise flow

An MSEL is the detailed chronological script for an exercise—listing each timed event, inject, or stimulus, the expected participant response, the responsible exercise controller, and evaluation criteria—enabling coordinated, controlled exercise facilitation.

Which section of the EOC is MOST responsible for tracking resource status and maintaining the incident documentation package?

Answer: Planning Section

The Planning Section is responsible for collecting, evaluating, and displaying incident information, including resource status and official documentation.

The Basel III framework influences BC/DR planning for banks primarily through its requirements for:

Answer: Operational risk capital adequacy and resilience standards

Basel III's Pillar 2 operational risk framework requires banks to hold adequate capital against operational risks, including those arising from disruptions, and to demonstrate robust operational resilience.

A BC program continuous improvement review identifies that plan maintenance tasks are consistently completed late. Applying a process improvement lens, the first step should be to:

Answer: Map the current plan maintenance process to identify where delays originate

Process mapping identifies where bottlenecks or inefficiencies occur before any solution is applied.

What does 'geographic diversity' mean in the context of DR site selection?

Answer: Ensuring the DR site is far enough from the primary to avoid the same localized disaster

Geographic diversity in DR site selection means placing the recovery site far enough from the primary site so that a regional disaster (hurricane, earthquake, flood) will not affect both simultaneously.

What is the primary distinction between a functional exercise and a full-scale exercise?

Answer: Functional exercises test a single function; full-scale tests the entire plan

A functional exercise tests specific functions or capabilities, while a full-scale exercise activates all aspects of the plan with real resource deployment.

Which of the following best describes the relationship between ISO 22301 and ISO 22313?

Answer: ISO 22301 specifies BCMS requirements for certification; ISO 22313 provides implementation guidance

ISO 22301 is the auditable requirements standard (using 'shall') against which organizations certify, while ISO 22313 is the companion guidance document (using 'should') that explains how to implement the requirements.