During a governance review, the information security manager notes that the IT director is named owner of the business continuity plan and business managers have not participated in developing it. What is the BEST recommendation?
Select an answer to reveal the explanation.
Short Explanation
Continuity is about keeping the business running, so you want the business to own it. IT is a vital supporting player, handling the technology recovery, but it can't decide which processes matter most. Handing the plan to yourself or to audit is the trap; neither one owns the business processes.
Full Explanation
A business continuity plan protects business processes, so ownership belongs with business leadership, usually an executive sponsor with process owners responsible for their own continuity arrangements. Business participation ensures the plan reflects real priorities, workarounds and dependencies, and gives it authority. IT's role is to plan and execute the recovery of the technology those processes rely on, typically through the disaster recovery plan. Keeping IT as owner because strategies depend on technology confuses a major dependency with ownership; many continuity decisions, such as staff relocation, manual workarounds and customer communication, lie outside IT entirely. Transferring ownership to the information security manager places the business's decisions with a role that facilitates and advises, and availability of business processes is a business accountability, not a security one. Having internal audit own the plan would destroy audit's independence, as it would then be auditing its own work, and audit does not run the business processes being protected. Exam caveat: a central continuity function may coordinate and maintain the method, but process ownership stays with the business. Operational check: confirm the plan names an executive owner from the business and that each critical process section is signed off by its process owner.