ExamworthyExamworthy
Open the appStart free

CISSP - Security and Risk Management - Section 1.7

Identify, analyse, assess, prioritise, and implement Business Continuity requirements including business impact analysis and external dependencies.

Conduct a business impact analysis (BIA) to identify critical processes, quantify recovery time objectives (RTO) and recovery point objectives (RPO), and map external dependencies. Prioritise continuity investments based on the relative impact and likelihood of disruption to each critical function.

business impact analysisBIARTORPOexternal dependencies

Practice question for this objective

Free sampleSecurity and Risk Managementhard

A logistics company has completed a BIA that identifies the warehouse management system as tier-one with an RTO of four hours and an RPO of fifteen minutes. The infrastructure team has proposed asynchronous replication to a warm site three hundred kilometres away on a link that introduces an average replication lag of twenty-two minutes. The CISO must advise whether the proposal meets the BIA. What is the BEST advice to give the business?

  • AAccept the design because the warm site can be brought online inside the four-hour RTO and the BIA's RPO is a target rather than a hard ceiling
  • BReject the design and require either synchronous replication, a shorter replication path, or a renegotiated RPO formally re-signed by the warehouse process owner Correct
  • CAccept the design but compensate by increasing the frequency of warehouse paper backups and manual reconciliation procedures after a failover
  • DEscalate the proposal to internal audit so that the gap between the replication lag and the RPO is documented as a finding for the next audit cycle
Reject a recovery design whose measured behaviour breaches the BIA's RPO, and force either an engineering change or a re-signed business tolerance. RPO is the maximum data loss the business has agreed it can absorb, derived during the BIA from the process owner. Replication lag is the actual data exposure of the candidate design. When lag exceeds RPO, the design fails the BIA by construction, and no amount of operational compensation closes the gap because the data has not reached the recovery site. CISSP expects the candidate either to fix the design or to make the business consciously raise the tolerance.

Why A is wrong: Reframing the RPO as a soft target is tempting because the RTO is comfortably met, but the RPO emerges from the business owner's tolerance for data loss and is a hard input to the design; accepting twenty-two minutes of lag against a fifteen-minute RPO knowingly breaches the BIA.

Why B is correct: Because measured replication lag exceeds the RPO, the design cannot meet the BIA as written; the only defensible paths are to engineer the lag down, change the topology, or have the process owner consciously raise the RPO, all of which keep the business decision visible.

Why C is wrong: Manual compensating controls do reduce business impact, but they recover data that was never replicated rather than meeting the RPO; presenting paper reconciliation as RPO compliance disguises a data-loss commitment the business has not agreed to.

Why D is wrong: Audit escalation is a reasonable governance step but it is not advice on whether to proceed; the CISO's role here is to refuse a design that knowingly breaches the BIA, not to defer the decision into the next audit window.

See more CISSP practice questions, answers explained.

More in this domain

Back to all Security and Risk Management objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.