A city IT shop runs three 'critical' applications on one shared vendor platform, but the BIA scores each application as if it could fail alone. What shared-dependency gap should the risk manager flag?
Select an answer to reveal the explanation.
Short Explanation
Think of three storefronts sharing one power pole—if the pole falls, all three go dark together. Scoring each app as if it fails alone hides that correlated hit. Call out the shared vendor so leadership sees the real blast radius.
Full Explanation
Business impact analysis for a municipal IT portfolio must expose shared upstream dependencies that create correlated failure. When three applications labeled critical all run on one vendor platform, scoring each as if it could fail alone systematically understates simultaneous outage impact, staffing demand, and citizen-facing service loss. Mapping the shared vendor into the BIA makes the common point of failure visible so leaders can prioritize contingency design, concentration risk treatment, and vendor assurance rather than pretending the three apps are independent recovery problems.
Treating each application as fully independent hides the correlated blast radius and produces optimistic impact estimates. Dropping the vendor from the BIA because platforms are “procurement issues” confuses buying mechanics with operational dependency—if the platform fails, business impact still lands on the city. Raising every RTO to same-day restore without documenting common points of failure papers over concentration risk with aggressive time targets that the shared dependency may make unreachable.
Exam caveat: CRMC-level BIA items often test whether candidates distinguish independent failure assumptions from shared-service correlation. Parallel criticality scores without dependency mapping are incomplete.
Operational check: list each critical civic application’s upstream platforms; flag any vendor supporting more than one high-criticality function; update the BIA so correlated outage scenarios and joint recovery demand appear in leadership summaries before the next continuity investment decision.