DRI Regulations, Standards, and Compliance 3

Question 1

Which element is NOT a required component of an ISO 22301 BCMS policy statement?

Accepted Answer

Specific RTO and RPO targets for critical processes

Answer

ISO 22301 requires the BC policy to include commitments to requirements, continual improvement, and protection against disruptions, but specific RTO/RPO values belong in BIA and strategy documents, not the high-level policy.

Question 2

The Payment Card Industry Data Security Standard (PCI DSS) Requirement 12.10 specifically addresses:

Accepted Answer

Incident response plan implementation and testing

Answer

PCI DSS Requirement 12.10 requires entities to implement an incident response plan and test it at least annually, ensuring readiness to respond to security events affecting cardholder data.

Question 3

A BC manager discovers that a critical vendor's SLA does not align with the organization's RTO. Under ISO 22301, the MOST appropriate first action is:

Accepted Answer

Document the gap in the risk register and assess impact through the BIA

Answer

ISO 22301 requires organizations to evaluate and address risks from interested parties (including suppliers); documenting the gap and assessing its impact through the BIA ensures a risk-based, evidence-based response.

Question 4

The Basel III framework influences BC/DR planning for banks primarily through its requirements for:

Accepted Answer

Operational risk capital adequacy and resilience standards

Answer

Basel III's Pillar 2 operational risk framework requires banks to hold adequate capital against operational risks, including those arising from disruptions, and to demonstrate robust operational resilience.

Question 5

NIST SP 800-34 Rev. 1 defines the Continuity of Operations Plan (COOP) as distinct from a Disaster Recovery Plan primarily because:

Accepted Answer

COOP addresses continuity of essential government functions, while DRP focuses on IT system recovery

Answer

NIST SP 800-34 defines COOP as planning for continuity of an organization's essential functions during and after emergencies, whereas the DRP focuses specifically on recovering IT systems and infrastructure.

(DRI) Disaster Recovery Institute International Certification Practice Test

(DRI) Disaster Recovery Institute International Certification Practice Test

DRI Regulations, Standards, and Compliance 3