Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IT Management > Business Continuity (BC) and Business Impact Analysis (BIA) > Flashcards

Business Continuity (BC) and Business Impact Analysis (BIA) Flashcards

1
Q

What is Business Continuity Planning (BCP)?

A

process of developing prior arrangements and procedures that enable organization to respond to an event so that critical business functions can continue within planned levels of disruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the primary goal of BCP?

A

enable organizations to maintain essential functions, minimize downtime, and recover critical operations as quickly as possible following a disruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the end result of the planning?

A

BC plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the Business Continuity Plan (BCP)?

A
  • overall organization plan for “how-to” continue business
  • documented collection of procedures and information that is developed, compiled and maintained in readiness for use in an incident
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Disaster Recovery Plan (DRP)?

A
  • the plan of recovering from a disaster impacting IT and returning the IT infrastructure to operation
  • technical aspect of business continuity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the difference between BCP and DRP?

A
  • BCP addresses the entire organization’s operations, including people, processes, technology, and facilities
  • DRP deals with the technical aspects of recovery, such as restoring IT systems, networks, databases, and applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Business Continuity Management Systems (BCMS)?

A
  • BCMS provides a systematic approach to BCP, incorporating risk assessment, business impact analysis, planning, implementation, testing, and continual improvement
  • some organizations adopt formal BCMS based on standards such as ISO 22301
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are three components of BCMS?

A
  • IRP (Incident Response Planning)
  • BCP (Business Continuity Planning)
  • DRP (Disaster Recovery Planning)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Business Continuity Plan is in place for what occasions?

A

the times when the duration of an incident affects business operations for an unacceptable period of time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does BCP integrates with?

A
  • BCP integrates with risk assessment and management processes to identify potential threats and vulnerabilities that could disrupt business operations
  • by understanding and mitigating these risks, organizations can develop effective BCP strategies tailored to their specific needs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Business Impact Analysis?

A
  • assessing impact over time of the potential disruptions or incidents on an organization’s critical business processes, systems, and resources
  • concerned with business impact analysis, not information systems impact analysis
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How is the impact measured in BIA?

A
  • quantitative measures
    • impact in money
  • qualitative
    • impact in reputation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the purpose of BIA?

A
  • identify and prioritize critical business functions (CBFs) and the potential impacts that could arise from their disruption
  • help organizations to understand the financial, operational, reputational, and legal consequences of disruptions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the key steps in BIA?

A
  • Identify Critical Functions
    • identify and prioritize the organization’s critical business functions, which are essential for its continued operation and achieving its objectives
  • Determine Impact Criteria
    • used to assess the consequences of disruptions
    • may include factors like financial loss, customer impact, regulatory compliance, reputation damage, and legal implications
  • Assess Impact and Dependencies
    • analyze the potential impact of disruptions on critical functions and identify the dependencies and interdependencies between processes, systems, and resources
  • Establish Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)
    • define the acceptable time frames for recovery of critical functions (RTO) and the acceptable level of data loss (RPO) that the organization can tolerate
  • Analyze Costs and Resources
    • evaluate the resources, personnel, equipment, and financial implications associated with recovering critical functions and maintaining business operations during a disruption
  • Document BIA Results
    • document the findings of the BIA, including the identified critical functions, impact assessments, dependencies, recovery objectives, and resource requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What’s Maximum Tolerable Downtime (MTD)?

A
  • determines the longest period of time that the business is unable to provide its core product until the business fails
  • represents the upper limit of acceptable downtime, beyond which the organization’s objectives and functions may be severely impacted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What’s Recovery Time Objective (RTO)?

A
  • defines when the business should recover to an acceptable level from the impact
  • represents the targeted timeframe for recovering the affected services, systems, or processes to ensure that they can resume normal operations or provide a minimum level of service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What’s Recovery Point Objective (RPO)?

A
  • represents the point in time to which data must be recovered in order to resume operations effectively
  • typically measured in terms of time and indicates the maximum acceptable time gap between the last data backup or synchronization and the point of failure or disruption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What’s Service Delivery Objective (SDO)?

A
  • targeted level of service availability and performance that an organization aims to achieve for its services or systems
  • typically defined in the context of service level agreements (SLAs) and outlines the specific requirements and expectations for service availability, response time, throughput, and other performance indicators
  • SDO is often tied to key performance indicators (KPIs) and is regularly monitored and reported to ensure that service levels are being met
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What’s Maximum Tolerable Outage (MTO)?

A
  • maximum allowable duration of time that a system or service can be unavailable or inaccessible before it significantly impacts the organization’s operations or goals until the business is restored to normal
  • encompasses not only the recovery of the system or service but also the time required for any necessary repairs, testing, and verification of functionality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What should emergency response guidelines include?

A
  • immediate steps organization should follow when responding to an emergency situation
  • immediate response procedures, list of individuals to contact, secondary response procedures for first responders
  • do not inlcude long-term actions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Does CEO serve in the BCP team?

A

no, but best to obtain top level management approval for the BCP plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is included in the project scope and planning of the BCP?

A
  1. structured analysis of the organization
  2. creation of BCP team
  3. assessment of available resources
  4. analysis of legal and regulatory landscape
23
Q

Is implementing RAID part of business continuity plan or disaster recovery?

A

business continuity

24
Q

Who should receive initial business continuity plan training in organizations?

A

everyone in the organization

25
Q

Is documentation of the plan part of the project scope and planning phase?

A

no

26
Q

Is statement of accounts normally included in business continuity plan documentation?

A

no

27
Q

What are the steps of BIA?

A
  1. Identification of priorities
  2. Risk identification
  3. Likelihood assessment
  4. Resource prioritization
28
Q

What is the minimum interval at which an organization should conduct business continuity plan refresher training for those with specific business continuity roles?

A

at least an annual basis

29
Q

What is the goal of the BCP process?

A

RTO < MTD

30
Q

What’s the first step when conducting BIA?

A

identify the business’s priorities

31
Q

What’s the major resource consumed by the BCP process during the project scope and planning phase?

A
  • the most significant resource utilization will be the time dedicated by members of the BCP team to the planning process (personnel)
  • represents a significant use of business resources and is another reason that buy-in from senior management is essential
32
Q

Business continuity planning process is conducted for an organization. What’s the first step that should be taken?

A

business organization analysis helps guide the remainder of the work

33
Q

In which business continuity planning task would you actually design procedures and mechanisms to mitigate risks deemed unacceptable by the BCP team?

A

In the provisions and processes phase, the BCP team designs the procedures and mechanisms to mitigate risks that were deemed unacceptable during the strategy development phase

34
Q

What are the benefits for addressing BC/DR offered by cloud operations?

A
  • distributed, remote processing and storage of data
  • fast replication
  • regular backups offered by cloud providers
35
Q

What are dependencies that must be considered when reviewing the BIA after cloud migration?

A
  • cloud provider’s suppliers
  • cloud provider’s vendors
  • cloud provider’s utilities
36
Q

What serves as a reliable guide for BC/DR activity?

A

checklists

37
Q

What kind of items should be included in BC/DR kit?

A

flashlight, documentation equipment, annotated asset inventory; BC/DR kit is intended to be compact

38
Q

After a cloud migration, the BIA should be updated to include a review of the new risks and impacts associated with cloud operations; this review should include an analysis of the possibility of vendor lock-in/lock-out. Analysis of this risk may not have to be performed as a new effort because a lot of the material that would be included is already available from which analysis?

A

cost-benefit analysis

39
Q

What are the possible notification avenues and who should be notified during a disaster?

A

telephone call tree rosters, website postings, SMS blasts; notifications should inclide organiztaion’s personnel, the public, and regulatory and response agencies, depending on who might be affected by the circumstance

40
Q

After human safety is addressed, what should be the next concern of the business?

A

continuity of critical operations

41
Q

What items should BC/DR plan include?

A
  1. critical asset inventory; includes necessary hardware, software, media …
  2. disaster criteria; balance the risk of overreaction and underreaction
  3. disaster declaration process; authority needs to be named for the purpose of formal declaration of an event or disaster (also declares cessation of BC/DR activity)
  4. essential points of contact; internal and external entities
  5. detailed actions, tasks and activities; checklists are helpful - constitute a record after the activity is complete
42
Q

How does BC/DR understand event?

A

any unscheduled adverse impact to the operating environment; distinguished from disaster by the duration of impact (lasts 3 days or less, disaster lasts longer)

43
Q

What is BC/DR toolkit?

A

a container that holds all the necessary documentation and tools to conduct a proper BC/DR action

44
Q

What should be the properties of the DR/BC toolkit?

A

secure, durable, compact

45
Q

Why should there be also a physical copy of the DR/BC toolkit?

A

the systems/internet connection might be unavailable during the disaster

46
Q

What should the BC/DR toolkit include?

A
  1. a current cocpy of the plan with all appendicees and addenda
  2. emergency and backup communication equipment
  3. copies of all appropriate network and infrastructure diagrams and architecture
  4. copies of all requisite software for creating a clean build of the critical systems, if necessary, with media containing appropriate updates and patches for current versioning
  5. emergency contact information
  6. decumentation tools and equipment (pens, paper, laptop …)
  7. small number of emergency essentials (flashlights, water, rations …)
  8. fresh batteries sufficient for operating all powered equipment in the kit for at least 24 hours
47
Q

How to ensure DR/BC kit is always available?

A

ensure there is a duplicate at at least one other location; if plan calls for relocation, the plan should be in the alternate location as well

48
Q

What is Recovery Service Level (RSL)?

A

proportion of service expressed as percentage that is necessary for continued operation during disaster; e.g. if manufacturing creates 10K pills an hour, business leaders may decide that 6K (60%) is only necessary for the time of the disaster

49
Q

What is the difference between Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP)?

A
  • BCP: the overall organization for “how-to” continue business
  • DRP: plan for recovering from a disaster impacting IT and returning the IT infrastructure to operation
50
Q

What are the two important items that BIA consist of?

A
  1. cost-benefit analysis (CBA)
  2. calculation of the return of investment (ROI)
51
Q

What is the purpose of cost-benefit analysis (CBA)?

A

list the benefits of the decision alongisde their corresponding costs; can be strictly quantitative

52
Q

What does a thorough cost-benefit analysis consider?

A

intangible benefits - those taht cannot be calculated directly

53
Q

What are the standards related to continuity management?

A
  • NIST Risk Management Framework and ISO 27000
    • both deal with business continuity and disaster recovery
  • HIPAA
    • mandates adequate data backups, disaster recovery planning and emergency access to healthcare data in the event of a system interruption
  • ISO 22301:2019
    • specifies the requirements needed for an organization to plan, implement and operate and continually improve the continuity capability

IT Management (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions