The organization's business impact analysis was completed five years ago. Since then it has launched online sales, closed two plants and outsourced payroll. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
A five-year-old BIA after that much change is like using an old city map after they've built new highways. You refresh the BIA first, then let the new recovery objectives reshape your plans. Don't be fooled by a successful test; you may have perfectly tested the wrong things.
Full Explanation
The BIA is the foundation of continuity and recovery planning, so it must reflect the current business. New revenue channels create new critical processes and dependencies, closed sites remove others, and outsourcing moves a process to a third party whose continuity must now be considered. The BIA should be reviewed periodically and whenever significant change occurs; here both conditions apply. Once updated, recovery objectives and the plans that depend on them should be revised. Keeping the old BIA because plans were tested successfully misses the point that a test only shows a plan meets its stated objectives, not that those objectives reflect today's business. Updating recovery plans for online sales alone, without first updating the BIA, sets recovery strategy without knowing the process's criticality or tolerances and ignores the other changes. Asking internal audit to rule on validity delays action that management already has clear reason to take, and maintaining the BIA is a management responsibility, not an audit one. Exam caveat: the review cycle should be defined in policy so updates do not depend on someone noticing. Operational check: confirm the BIA has a recorded review date, a trigger list of significant changes, and process owner sign-off on the current version.