3.3

You are a database administrator and the first responder for database attacks. You have decided to test one part of your current Business Continuity Plan (BCP) with two other database professionals. Which type of BCP test is this considered?

In a tabletop exercise, a small number of individuals get together and test just one part of the BCP by working through a simple scenario. A medium exercise involves a large number of individuals that test many parts of the BCP. A complex exercise involves a very large number of individuals and a very realistic scenario. Succession planning is a process for identifying and developing internal personnel with the potential to fill key positions.

As a BCP or DRP plan evolves over time, what is the most important task to perform when rolling out a new version of the plan?

It is essential to collect and destroy all old plan copies as a new version of a plan is rolled out. Senior management approval should have been obtained before releasing a new version of the plan. New awareness sessions are usually not required as the major concepts and ideas of the plan remain constant; it is only the details that need periodic updates. New awareness is necessary only when the plan significantly changes or when a significant length of time has elapsed since the last time employees went through awareness. Roles and responsibilities do not need to be redefined due to a new plan version, just updated.

When is a BCP or DRP design and development actually completed?

BCP and DRP developments are never complete as they need constant improvement and updates. Senior management approval, testing, drilling, implementation, and distribution are all important phases and elements in the life of BCP and DRP projects. However, they do not represent the end point of BCP/DRP design and development.

In business continuity planning, what is the primary focus of the scope?

Business processes are the primary focus of the scope of BCP. Company assets are the focus of risk assessment for security policy development, not BCP. Human life and safety are considerations for emergency response, but are not the focus of the BCP scope. Recovery time objective is a consideration in emergency response plans, not an aspect of BCP scope.

When recovering from a disaster, which services should you stabilize first?

Mission-critical The services you should restore first are mission-critical services. If mission-critical services are not restored within their maximum tolerable downtime, the organization is no longer viable. Least business-critical services should be restored last. Financial support and outside communications should be restored only after all other services with a higher level of criticality are restored.

What is the primary goal of business continuity planning?

The primary goal of BCP is maintaining business operations with reduced or restricted infrastructure capabilities or resources. Minimizing the risk of service delays and interruptions is a goal of DRP. If your organization cannot provide services, it is experiencing a disaster. Minimizing decision-making during the development process is not a valid goal of BCP or DRP; decisions should be made during development. The correct DRP goal is to minimize decisions during an emergency. Protecting an organization from major computer services failure is a goal of DRP, not BCP. If computer services fail, business continuity is interrupted, creating a disaster.