Question 1

Which of the following scenarios demand coming up with a new business continuity and crisis management plan rather than editing the existing plan?&#10;A)Natural disaster&#10;B)M&A&#10;C)Accident affect manufacturing capability&#10;D)Flu pandemic&#10;E)All of the above

Accepted Answer

The existing BCP should address natural disasters, loss of manufacturing capability and pandemic events. However, a merger or acquisition is almost impossible to plan for and requires a new BCP project for the integrated firm.
Key takeaway: M&A activity leads to a paradigm shift in organizational processes and systems. Often the methods and controls become ineffective for new combined activity. It is imperative that planning is done afresh to address disaster management needs.

Question 2

Which of the following are effective business continuity planning strategies for firms in the same region? Select all that apply:&#10;A)Copying business continuity plan across all companies.&#10;B)Mutual aid agreement&#10;C)Carrying out drill simultaneously&#10;D)Sharing metrics for BCP testing to define/modify benchmarks

Accepted Answer

All companies should have their own business continuity plan. However, a group of organizations facing similar threats will have similar mitigation strategies as well. It is beneficial and cost effective if mutual aid agreements can be signed to help improve the response to a threat. Also, the organizations can share best practices to gauge what response times should be.
Key takeaway: A mutual aid agreement and sharing of best practices can help lower the cost of BCP while increasing effectiveness.

Question 3

List the following resources sequentially, based on their relative importance to the business continuity planning process:
IT systems
Communication systems
People
Fixtures and furniture

A)A) Fixtures and furniture, IT systems, people, communication systems
B)A) People, IT systems, communication systems, fixtures and furniture
C)A) People, communication systems, IT systems, fixtures and furniture
D)A) IT systems, communication systems, people, fixtures and furniture

A) People, communication systems, IT systems, fixtures and furniture

Accepted Answer

The relative importance of various resources with respect to business continuity are as follows:
People
Communication systems
IT systems
Fixtures
Key Takeaway: The protection of human life and well-being is the most important objective. Period.

Question 4

In an IT services company, what is the relationship between project plans to complete work for the client and business continuity plan?&#10;A)Project plans act as an input to business continuity planA. Business continuity planning acts as an input to project planning&#10;B)A) Business continuity planning acts as an input to project planning&#10;C)Both of the above&#10;D)Neither of the above

Accepted Answer

For an IT organization offering services to its customers, there is a 2 way planning required for business continuity:
-Standards driven by client needs to ensure that impact on delivery of services is minimized
-Driven by the service company's internal BCP needs
Key takeaway: In a service organization, project plan (for all ongoing projects) and business continuity plan feed into each other for catering to client and the organization's needs. The stricter of two norms (say for RPO or RTO) must always apply.

Question 5

An IT organization has identified that recovery time is the most critical measurable criteria for its risk management strategy. If this is the case, the company should consider investing in what?&#10;A)Backup site&#10;B)Hot site&#10;C)Cold site&#10;D)SCSI

Accepted Answer

A hot site speeds recovery time the most out of any of the options.
Key takeaway: A hot site provides all the equipment, space, furniture and communication tools needed for the enterprise to continue operation. Some companies operate hot sites of their own, but generally it is a commercial service.

Question 6

Joe's Recovery Point Objective (RPO) is set to 24 hours. What does this mean?&#10;A)Joe's people must be in the office performing the process 24 hours after a disaster or disruption.&#10;B)Joe has 24 hour to decide what to do in event of an emergency.&#10;C)No more than 24 hours of data can be lost.&#10;D)All data related to the process must be recovered within 24 hours.&#10;E)Joe's process must be restored after 24 hours.

Accepted Answer

Recovery Point Objective (RPO) describes the acceptable amount of data loss measured in time.
Key Takeaway: Typically, the smaller the RPO, the greater the cost to implement the backup system. For instance, a RPO of zero means that you must mirror system. A RPO of 24 hours means you might do nightly backup. A manager must carefully assess what is an appropriate RPO for a specific system.

Deck 4: Development Implementation