Business Continuity and Resilience Flashcards

A GRC analyst is assessing which business functions to prioritize in recovery. Which tool best supports this decision?

Answer: Business Impact Analysis (BIA)

The BIA identifies critical business functions, their dependencies, and the impact of disruption, directly informing recovery prioritization.

What term describes the maximum time a business process can be disrupted before the impact becomes unacceptable?

Answer: Maximum Tolerable Downtime (MTD)

MTD (also called MTPD — Maximum Tolerable Period of Disruption) defines the absolute maximum time a process can be unavailable before causing irreversible harm.

During a parallel test, IT successfully restored systems at the alternate site while production remained online. What is the main limitation of this test?

Answer: It does not verify that staff can actually shift to the alternate site under real conditions

A parallel test validates technical recovery but does not prove the organization can fully operate from the alternate site since production is still running.

Which BCP element ensures that third-party vendors critical to operations also maintain adequate continuity plans?

Answer: Vendor risk management and supply chain continuity requirements

Vendor risk management provisions in BCP require suppliers and critical third parties to demonstrate their own business continuity capabilities.

A firm experiences a ransomware attack that encrypts all production data. Which BCP/DRP control would be most immediately useful?

Answer: Clean, tested, and isolated data backups

Isolated and regularly tested backups allow data restoration without paying ransom, making them the primary recovery control for ransomware incidents.

Which concept refers to the ability of an organization to anticipate, prepare for, respond to, and adapt to incremental change and sudden disruptions?

Answer: Organizational resilience

Organizational resilience encompasses the adaptive capacity of a business to withstand and recover from both gradual changes and abrupt disruptions.

What should happen to a BCP immediately after an organization undergoes a major merger or acquisition?

Answer: The plan must be reviewed and updated to reflect new organizational scope and dependencies

Major organizational changes like mergers alter critical processes, personnel, systems, and dependencies, requiring immediate BCP review and revision.