A major reorganization has merged several departments, changed reporting lines and replaced many of the managers named in the business continuity plan. What should the information security manager ensure happens?
Select an answer to reveal the explanation.
Short Explanation
A continuity plan full of names that no longer work there is like an emergency contact list for someone else's family. After a big reorganization, you update the roles and contacts, then test and communicate the changes. Waiting for the annual review is the trap; a crisis won't wait for it.
Full Explanation
A business continuity plan is only usable if its roles, decision makers, contacts and process descriptions match the organization as it is. Organizational change is a standard trigger for plan maintenance: the plan should be updated for the new structure, revised roles assigned to named people with alternates, contact details refreshed and the changes communicated to everyone with a role. A walkthrough or exercise then confirms the new team understands the plan. Waiting for the annual review because processes are unchanged ignores that the people who execute the plan have changed, which is exactly what makes it fail in a real event. Handing over printed copies transfers outdated documents rather than updating them, and new managers in merged departments may not even inherit the same responsibilities. An audit at the next planned date gives assurance after the fact and does not itself update the plan; maintaining it is management's responsibility. Exam caveat: change management processes should notify the continuity function of organizational changes automatically, so updates do not depend on chance discovery. Operational check: compare the plan's named roles against the current organization chart and confirm every role has a current primary and alternate who has acknowledged it.