DerpGRC

    Topics in this domain

    Business Continuity Planning and Governance

    Resilience · 1 min read

    The BCP life cycle

    Policy and scope, BIA, risk assessment, strategy, write the plan, train, test, maintain.

    After management commitment, the business impact analysis comes first. It drives recovery objectives and strategies.

    BCP and DRP

    BCP keeps the business running: people, processes, suppliers, communication, technology. DRP gets IT back, aligned to BCP priorities.

    Strategies for each kind of loss

    Continuity strategies for loss of site, IT, people and supplier.

    Governance

    • Senior management sponsors and approves the program.
    • Business owners own their process plans.
    • Continuity risks appear in the risk register.
    • Tests and lessons feed back into the plans.

    Example. A regional bank’s continuity plan covered IT failover well, but the BIA had never considered the loss of its single cash-handling supplier. When that supplier failed, branches ran short for a week. Supplier continuity became a top-ten risk.

    How the exam asks about it

    If the question asks…The answer is usually…
    FIRST step after management commitmentBusiness impact analysis
    Who owns business continuitySenior management and business owners
    Relationship between BCP and DRPDRP is part of BCP
    Plan not updated after a reorganisationA significant weakness; update and retest

    In short

    • Business continuity keeps critical business processes running; disaster recovery restores IT within it.
    • After management commitment, the BIA comes first and drives recovery objectives and strategies.
    • Strategies cover loss of site, IT, people and suppliers, not only technology.
    • Plans must be trained, tested and maintained after every significant change.
    • Senior management owns continuity; the risk practitioner links it to the risk profile and appetite.

    Exam traps

    • Treating continuity as an IT-only project.
    • Writing strategies before completing the BIA.
    • Plans that cover technology but forget people and suppliers.
    • Plans never updated after organisational change.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 4 · Resilience

    Business Continuity Planning and Governance

    How business continuity planning keeps critical processes running through disruption, from the BIA to strategies, plans, training and maintenance, and how it links to IT risk management.

    1 / 8