2 cissp ® Official Study Guide Eighth Edition

Explain the steps of the business impact assessment process. 
The five steps of the business 
impact assessment process are identification of priorities, risk identification, likelihood as-
sessment, impact assessment, and resource prioritization.
Describe the process used to develop a continuity strategy. 
During the strategy development 
phase, the BCP team determines which risks will be mitigated. In the provisions and pro-
cesses phase, mechanisms and procedures that will mitigate the risks are designed. The plan 
must then be approved by senior management and implemented. Personnel must also receive 
training on their roles in the BCP process.
Explain the importance of fully documenting an organization’s business continuity plan. 
Committing the plan to writing provides the organization with a written record of the proce-
dures to follow when disaster strikes. It prevents the “it’s in my head” syndrome and ensures 
the orderly progress of events in an emergency.
Written Lab
1.
Why is it important to include legal representatives on your business continuity
planning team?
2.
What is wrong with the “seat-of-the-pants” approach to business continuity planning?
3.
What is the difference between quantitative and qualitative risk assessment?
4.
What critical components should be included in your business continuity training plan?
5.
What are the four main steps of the business continuity planning process? 

---

Review Questions 
121
Review Questions
1.
What is the first step that individuals responsible for the development of a business 
continuity plan should perform?
A.
BCP team selection
B.
Business organization analysis