Isaca Updated CRISC Exam Questions and Answers by andrei

Business Impact Analysis (BIA):

Purpose: A BIA is a systematic process to evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency.

Identification of Consequences: It identifies critical resources and the consequences of their loss, allowing an organization to determine the operational and financial impacts of such losses.

Steps Involved in BIA:

Identify Critical Functions: Determine which business functions and processes are essential to the organization ' s operations.

Assess Impact: Evaluate the impact of losing these functions on the organization’s ability to operate.

Estimate Downtime Tolerance: Determine the maximum allowable downtime for critical functions before significant harm occurs.

Identify Dependencies: Document dependencies between systems, processes, and resources to understand how disruptions to one part affect the whole.

Comparison with Other Options:

Risk Management Action Plans: These are detailed plans developed to address identified risks but do not specifically focus on the impact of losing critical resources.

What-if Technique: This is a brainstorming technique used to explore potential risks and their impacts but is not as structured as a BIA.

Tabletop Exercise Results: These exercises simulate disaster scenarios to test response plans but do not provide the comprehensive impact analysis that a BIA does.

Best Practices:

Regular Updates: Regularly update the BIA to reflect changes in the business environment and operational dependencies.

Integration with DR/BC Plans: Ensure that findings from the BIA are integrated into disaster recovery (DR) and business continuity (BC) plans to enhance overall preparedness.

According to the CRISC Review Manual, conducting a business impact analysis (BIA) is the task that should be completed prior to creating a disaster recovery plan (DRP), because it helps to identify the critical business processes and resources, and their dependencies, that need to be recovered in the event of a disaster. The BIA also helps to determine the recovery timeobjectives (RTOs) and recovery point objectives (RPOs) for each business process and resource, which are the key inputs for the DRP. The other options are not the tasks that should be completed prior to creating a DRP, as they are part of the DRP itself. Identifying the recovery response team is the task of defining the roles and responsibilities of the personnel involved in the recovery process. Procuring a recovery site is the task of selecting and acquiring an alternative location where the business operations can be resumed. Assigning sensitivity levels to data is the task of classifying the data based on its importance and protection requirements. References = CRISC Review Manual, 7th Edition, Chapter 5, Section 5.2.1, page 237.

According to the CRISC Review Manual1, authorizing user access requests is the process of granting or denying access to IT resources based on the user’s role, responsibilities, and business needs. Authorizing user access requests is a key control accountability that should be retained within the organization, as it helps to ensure that the principle of least privilege is applied, and that the access rights are aligned with the organization’s policies, standards, and risk appetite. Authorizing user access requests also helps to prevent unauthorized access, data leakage, fraud, and other potential risks associated with user access provisioning and termination. Therefore, the best control accountability to retain within the organizationwhen a third-party vendor offers to perform user access provisioning and termination is authorizing user access requests. References = CRISC Review Manual1, page 240.