A city clerk’s office must keep issuing marriage licenses if the permit software is offline for a week. IT DR restores servers, but leadership asks security to join broader continuity work. What should that participation emphasize?
Select an answer to reveal the explanation.
Short Explanation
Servers coming back is DR. Keeping licenses flowing with desks, forms, and workarounds is BC. Security’s seat at that table means the public still gets served while IT digs out.
Full Explanation
Business continuity planning (BCP) keeps the public-facing function alive when supporting IT is unavailable for an extended period. For a city clerk’s office that must keep issuing marriage licenses during a week-long permit-software outage, security’s contribution to broader continuity work emphasizes alternate workspaces, staffing plans, manual or paper processes, and exercises that prove those workarounds under realistic conditions. IT disaster recovery restores servers and applications; BCP ensures residents can still complete civic transactions while that restoration proceeds. Security joins that table to protect sensitive personal data in paper workflows, control access to temporary sites, and align continuity procedures with acceptable risk.
Only rewriting firewall rules until the primary datacenter is rebuilt is a narrow technical recovery task; it does not sustain license issuance at the counter. Deferring all continuity work until a full interruption DR test completes leaves the clerk’s office without interim procedures during the exact outage window citizens experience. Limiting the plan to restoring virtual machines while ignoring staffing and workspace needs confuses DR with BCP and fails when people have nowhere to work or no manual process to use.
Exam caveat: CISSP frequently contrasts DR (technology recovery) with BC (business-function continuity). Alternate facilities, manual processes, and workforce continuity are classic BCP elements. Participation by security does not mean replacing emergency management—it means embedding confidentiality, integrity, and availability thinking into those continuity measures.
Operational check: for each citizen-facing process with multi-day IT dependency, inventory paper/manual fallbacks, designate alternate desks or sites, schedule continuity drills separate from pure DR failover tests, and confirm privacy and cash-handling controls still apply when systems are dark.