I85PREP
⌘ K
ISO 22301 LI study materials
ISO 22301 LI study resources

ISO 22301 LI practice questions

One question at a time. Build your ISO 22301 LI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a BCMS

What is the primary purpose of a business continuity management system (BCMS)?

  1. To replace the organization's information security management system
  2. To build organizational resilience so that critical services can continue during and after disruption Correct answer.
  3. To satisfy insurance providers before a policy is issued
  4. To guarantee that an organization will never experience a disruptive incident

Explanation

A BCMS is a management system that establishes, implements, operates, monitors, and continually improves business continuity, with the aim of protecting critical services and building resilience. It cannot prevent all incidents, but it prepares the organization to respond and recover.

Question 2Fundamental principles and concepts of a BCMS

In business continuity terminology, what does 'disruption' refer to?

  1. An event that interrupts the expected delivery of products or services Correct answer.
  2. A routine audit finding that requires corrective action
  3. A financial variance between budgeted and actual costs
  4. A planned change to the organization's product portfolio

Explanation

A disruption is an incident or situation that interrupts, or has the potential to interrupt, the delivery of products and services at expected levels. It is the trigger that a BCMS is designed to anticipate and respond to.

Question 3Fundamental principles and concepts of a BCMS

Which statement best describes the relationship between business continuity and disaster recovery?

  1. Disaster recovery focuses on restoring technology and data, while business continuity addresses the whole organization's ability to continue operating Correct answer.
  2. Disaster recovery applies only to public-sector organizations, whereas business continuity applies to all organizations
  3. Disaster recovery is a broader discipline that fully contains business continuity
  4. Business continuity and disaster recovery are identical concepts with different names

Explanation

Disaster recovery is generally a technology-centric subset concerned with restoring IT systems and data, whereas business continuity takes an organization-wide view of maintaining critical products and services. The two are complementary, with DR often supporting the wider BCMS.

Question 4Fundamental principles and concepts of a BCMS

What is the main role of top management within a BCMS?

  1. To personally execute recovery procedures during an incident
  2. To conduct every business impact analysis interview themselves
  3. To provide leadership, direction, and resources so the BCMS achieves its intended outcomes Correct answer.
  4. To delegate all continuity decisions to an external consultant

Explanation

Top management demonstrates leadership and commitment by establishing policy, assigning roles, providing resources, and integrating continuity into business processes. Execution of procedures is delegated to trained teams, not necessarily performed by executives.

Question 5Fundamental principles and concepts of a BCMS

Why does a BCMS require a documented business continuity policy?

  1. To record the names of every employee in the organization
  2. To satisfy the requirement that every procedure be at least ten pages long
  3. To provide a formal statement of intent and direction that guides continuity objectives and commitments Correct answer.
  4. To replace the need for any continuity objectives or planning

Explanation

A continuity policy communicates management's intent, establishes the framework for setting objectives, and signals commitment across the organization. It is a governing document rather than a substitute for objectives or detailed plans.

Question 6Fundamental principles and concepts of a BCMS

What distinguishes a 'critical' business activity in a BCMS?

  1. It is any activity that generates a profit in the current quarter
  2. It is an activity that has been outsourced to a third party
  3. It is an activity whose failure would cause unacceptable harm to the organization's objectives or obligations Correct answer.
  4. It is the activity with the largest headcount assigned to it

Explanation

Criticality is judged by the consequences of failure, particularly the unacceptable impact on objectives, obligations, reputation, or survival. Size, profitability, and sourcing model do not by themselves determine criticality.

Question 7Fundamental principles and concepts of a BCMS

How does a BCMS support the concept of continual improvement?

  1. By avoiding measurement so that weaknesses remain hidden
  2. By applying recurring cycles of review, exercise, and corrective action to raise performance over time Correct answer.
  3. By freezing continuity plans once they are approved
  4. By replacing all staff after each incident

Explanation

Continual improvement in a BCMS is achieved through repeated cycles of monitoring, review, exercising, and corrective action, mirroring the plan-do-check-act model. This keeps continuity capability relevant as the organization and its risks change.

Question 8Fundamental principles and concepts of a BCMS

What does 'organizational resilience' mean in the context of business continuity?

  1. The ability to absorb disruption and adapt so that critical objectives continue to be met Correct answer.
  2. The physical strength of an organization's buildings and facilities
  3. The total amount of insurance coverage the organization holds
  4. The number of continuity plans stored in the document repository

Explanation

Organizational resilience is the ability of an organization to anticipate, prepare for, respond to, and adapt to disruptions so that it can survive and prosper. It is a capability of the whole organization, not a physical or financial attribute.

Question 9Fundamental principles and concepts of a BCMS

An organization identifies that its order-processing service must resume within four hours of a disruption. Which BCMS concept does this four-hour figure represent?

  1. The recovery point objective
  2. The service level agreement
  3. The recovery time objective Correct answer.
  4. The maximum tolerable period of disruption

Explanation

The recovery time objective (RTO) is the target time set for resuming a service or activity after disruption. It is set within, and must not exceed, the maximum tolerable period of disruption.

Question 10Fundamental principles and concepts of a BCMS

A business impact analysis reveals that a warehouse can operate for up to 72 hours on manual processes before customer commitments are breached. What does this 72-hour figure describe?

  1. The maximum tolerable period of disruption Correct answer.
  2. The recovery point objective
  3. The incident escalation threshold
  4. The minimum business continuity objective

Explanation

The maximum tolerable period of disruption (MTPD) is the longest time an activity can be unavailable before its absence causes unacceptable impact. The 72-hour limit reflects that tolerable boundary.

Question 11Fundamental principles and concepts of a BCMS

Why must recovery time objectives for dependent activities be aligned with those of the activities they support?

  1. Because RTOs are set by external regulators and cannot be changed
  2. Because dependent activities always have longer RTOs than the activities they support
  3. Because a supporting activity must be recovered in time for the activity that relies on it to meet its own RTO Correct answer.
  4. Because aligning RTOs eliminates the need for a business impact analysis

Explanation

Dependencies create a chain of timing constraints: if activity A depends on activity B, then B's recovery must occur early enough for A to meet its own recovery target. Misalignment means the supported activity cannot resume on time even if its own plan is sound.

Question 12Fundamental principles and concepts of a BCMS

What is the primary purpose of conducting exercises and tests within a BCMS?

  1. To satisfy a one-time requirement that never needs repeating
  2. To validate that plans and capabilities work as intended and to identify improvements Correct answer.
  3. To demonstrate to customers that no disruption will ever occur
  4. To assign blame to individuals whose procedures failed

Explanation

Exercising and testing validate plans, train participants, reveal gaps, and feed improvements back into the BCMS. They are recurring activities that build confidence in continuity capability.

Question 13Fundamental principles and concepts of a BCMS

A continuity team uses a tabletop exercise to walk through a hypothetical outage. Which outcome best demonstrates that the exercise achieved its purpose?

  1. The team decides that future exercises are unnecessary because the discussion went smoothly
  2. The team records attendance but makes no changes to any plan
  3. The team confirms the plan reads well and files it without discussion
  4. The team identifies a missing contact list and agrees an owner and deadline to correct it Correct answer.

Explanation

The value of an exercise lies in discovering gaps and converting them into corrective actions with clear ownership. A smooth discussion that produces no improvements suggests the exercise has not been used to test assumptions.

Question 14Fundamental principles and concepts of a BCMS

Which statement correctly distinguishes a business continuity plan from an incident response plan?

  1. The incident response plan replaces the business continuity plan once an incident begins
  2. The business continuity plan focuses on sustaining critical services over an extended period, while incident response focuses on immediate containment and management of the event Correct answer.
  3. The business continuity plan is used only after an incident is fully resolved
  4. The incident response plan covers only financial reporting, while the business continuity plan covers operations

Explanation

Incident response addresses the immediate handling and containment of an event, while business continuity planning addresses how critical services continue during and after disruption. They operate at different time horizons and complement each other.

Question 15Fundamental principles and concepts of a BCMS

Why is senior management approval of the business impact analysis results important?

  1. It transfers legal liability for disruptions to the executives
  2. It removes the need to communicate results to other stakeholders
  3. It confirms that the analysis was technically formatted correctly
  4. It validates the impact tolerances and priorities that the rest of the BCMS will be built upon Correct answer.

Explanation

The BIA produces impact ratings and recovery priorities that drive strategy and planning; management validation ensures these judgments reflect the organization's risk appetite and obligations. Without that endorsement, downstream decisions rest on unconfirmed assumptions.

Question 16Fundamental principles and concepts of a BCMS

What is the role of a business continuity strategy in a BCMS?

  1. To define how the organization will protect and recover prioritized activities before a disruption occurs Correct answer.
  2. To describe the organization's marketing approach to new markets
  3. To list the names of every supplier the organization uses
  4. To record the minutes of every management review meeting

Explanation

Continuity strategies set out the chosen approaches-such as redundancy, alternate sites, or manual workarounds-for protecting prioritized activities and meeting recovery objectives. They bridge the BIA findings and the detailed plans.

Question 17Fundamental principles and concepts of a BCMS

An organization discovers that a key supplier has no continuity arrangements of its own. How should this be treated within the BCMS?

  1. Assume the supplier will recover because it is large
  2. Treat it as a supply-chain dependency risk and evaluate mitigation options such as alternate suppliers or contractual requirements Correct answer.
  3. Ignore it, because supplier failures are outside the organization's scope
  4. Remove the supplier from the register so the risk disappears

Explanation

Dependencies on suppliers are part of the organization's own continuity exposure, and the BCMS should assess and mitigate them through options like alternate sourcing or contractual continuity obligations. Ignoring or hiding the risk does not remove its impact.

Question 18Fundamental principles and concepts of a BCMS

Which of the following best illustrates the principle of 'protection' within business continuity?

  1. Negotiating a discount with a facilities vendor
  2. Conducting a post-incident review after services have been restored
  3. Installing backup power and data replication to reduce the likelihood or impact of disruption Correct answer.
  4. Publishing an annual report describing continuity achievements

Explanation

Protection encompasses preventive and mitigating measures that reduce the likelihood or consequence of disruption, such as redundant power or data replication. Reviews and reporting are response and governance activities rather than protective controls.

Question 19Fundamental principles and concepts of a BCMS

How does situational awareness contribute to an effective BCMS?

  1. It replaces the need for communication with external stakeholders
  2. It removes the need for a business impact analysis
  3. It ensures that management is informed of emerging threats and the current state of continuity capability so decisions can be timely Correct answer.
  4. It guarantees that no incident will escalate

Explanation

Situational awareness gives decision-makers timely information about threats, incidents, and the readiness of continuity arrangements. This supports proportionate and prompt decisions during both normal operations and disruption.

Question 20Fundamental principles and concepts of a BCMS

Why should business continuity arrangements be integrated with the organization's other management systems and processes?

  1. Because integration allows continuity considerations to be embedded in everyday decisions such as change and procurement Correct answer.
  2. Because integration makes external audits unnecessary
  3. Because integration transfers continuity responsibility to the finance function
  4. Because integration eliminates the need for a continuity policy

Explanation

Embedding continuity into processes such as change management, procurement, and risk management means continuity is considered routinely rather than only during a crisis. Integration strengthens the BCMS by making it part of how the organization operates.

Question 21Fundamental principles and concepts of a BCMS

Which element most directly provides the evidence that a BCMS is operating as intended over time?

  1. A signed policy displayed in the reception area
  2. A statement in the annual report that continuity is important
  3. Records of monitoring, exercises, and corrective actions maintained across review cycles Correct answer.
  4. A single planning workshop held at the start of the programme

Explanation

Ongoing records of monitoring, exercising, and corrective action demonstrate that the BCMS is functioning and improving, not merely designed. Evidence of operation is what distinguishes a living management system from documentation alone.

Question 22Fundamental principles and concepts of a BCMS

An organization sets an RTO of 8 hours for a service but its tested recovery capability is 20 hours. What is the most appropriate interpretation?

  1. The service is not critical and should be removed from scope
  2. The RTO should be raised to 20 hours to match current capability
  3. The test result should be disregarded because it reflects only one scenario
  4. There is a capability gap that requires either investment to meet the RTO or a justified revision of the objective Correct answer.

Explanation

A gap between the target recovery time and demonstrated capability signals that the continuity strategy is insufficient or the objective is unrealistic. The organization must close the gap through investment or formally justify a revised objective based on impact tolerance.

Question 23Fundamental principles and concepts of a BCMS

Why does the concept of 'maximum tolerable period of disruption' take precedence over recovery time objectives when continuity strategies are designed?

  1. Because the MTPD represents the point of unacceptable impact, and RTOs are targets that must be set within that boundary Correct answer.
  2. Because the MTPD is a legal requirement in every jurisdiction
  3. Because RTOs are always shorter than the MTPD and therefore irrelevant
  4. Because the MTPD is set by the IT department while RTOs are set by the business

Explanation

The MTPD defines the outer limit beyond which impact becomes unacceptable; RTOs are internal targets chosen to provide margin within that limit. If an RTO exceeds the MTPD, the strategy cannot protect the organization from unacceptable harm.

Question 24Fundamental principles and concepts of a BCMS

An organization's continuity plan works well for a single-site power failure but has never been tested for a simultaneous loss of two data centres. What does this reveal about the BCMS?

  1. The plan should be shortened so it is easier to test
  2. The organization should stop exercising to avoid discovering further weaknesses
  3. The BCMS is fully mature because one scenario has been validated
  4. The scope of exercising is too narrow to confirm capability against plausible higher-impact scenarios Correct answer.

Explanation

Exercising must reflect a credible range of scenarios, including severe and combined events, to confirm that strategies hold under stress. Validating only one benign scenario leaves significant uncertainty about capability.

Question 25Fundamental principles and concepts of a BCMS

How should the BCMS treat an activity that is performed entirely by an external provider but is essential to the organization's own service delivery?

  1. Exclude it because the organization does not perform the work itself
  2. Assume the provider's certifications guarantee continuity and take no further action
  3. Transfer all accountability to the provider and remove it from management review
  4. Include it in scope and manage the dependency through impact analysis, contractual requirements, and contingency options Correct answer.

Explanation

Accountability for essential services remains with the organization even when delivery is outsourced, so the dependency must be analyzed and managed. Contractual continuity obligations and contingency options are typical mitigation measures.

Question 26Fundamental principles and concepts of a BCMS

An organization's BCMS has identified a risk of flooding at its main data center. Which action best exemplifies the 'mitigation' component of business continuity?

  1. Purchasing insurance to cover potential flood damage.
  2. Developing a crisis communication plan for flood events.
  3. Relocating the data center to a higher floor and installing flood barriers. Correct answer.
  4. Conducting an annual flood evacuation drill.

Explanation

Mitigation involves taking proactive measures to reduce the likelihood or impact of a disruption. Relocating the data center and installing flood barriers directly reduce the risk, whereas insurance, communication plans, and drills are preparedness or response activities.

Question 27Fundamental principles and concepts of a BCMS

In the context of a BCMS, what is the primary purpose of a business impact analysis (BIA)?

  1. To identify the organization's critical activities and the impact of their disruption over time. Correct answer.
  2. To document the recovery procedures for IT systems.
  3. To assign roles and responsibilities for the crisis management team.
  4. To list all potential threats and their probabilities.

Explanation

The BIA is a core BCMS process that identifies critical business activities and quantifies the operational and financial impacts of their disruption over time. It provides the basis for setting recovery objectives and strategies.

Question 28Fundamental principles and concepts of a BCMS

An organization's BCMS has defined a recovery time objective (RTO) of 4 hours for a critical service. During an incident, the service is restored in 6 hours. Which statement best evaluates this outcome?

  1. The recovery exceeded the RTO, so the RTO should be increased to 6 hours to match actual performance.
  2. The recovery exceeded the RTO, indicating a need to review recovery capabilities and possibly revise the strategy. Correct answer.
  3. The recovery met the RTO because the service was restored within the maximum tolerable period of disruption.
  4. The recovery met the RTO because the service was restored within the same business day.

Explanation

An RTO is the target time within which a service must be restored; taking 6 hours exceeds the 4-hour target. This indicates a gap between planned and actual recovery capability, which should trigger a review of the recovery strategy and capabilities.

Question 29Fundamental principles and concepts of a BCMS

A newly appointed continuity manager is asked to describe the core objective of a business continuity management system. Which statement best captures that objective?

  1. It guarantees that no disruption will ever affect the organization's operations.
  2. It replaces the organization's risk management framework with a dedicated crisis function.
  3. It focuses solely on restoring IT infrastructure after a technical failure.
  4. It builds organizational resilience so that critical products and services can continue at an acceptable, predefined level during and after a disruption. Correct answer.

Explanation

A BCMS is a management system whose purpose is to prepare for, respond to, and recover from disruptive incidents so that prioritized activities and their dependent services continue at an acceptable level. It is a resilience capability embedded in the organization, not a guarantee against disruption, and it complements rather than replaces other management disciplines.

Question 30Initiation of a BCMS implementation

Which document formally authorizes a business continuity management system (BCMS) project and gives the sponsor the mandate to commit resources?

  1. The internal audit programme
  2. The business continuity policy
  3. The project mandate or charter Correct answer.
  4. The business impact analysis report

Explanation

A BCMS implementation is a project, and a project mandate or charter formally authorizes it and assigns authority to the sponsor. The business continuity policy is a higher-level commitment statement that the BCMS produces or adopts, not the project authorization.

Question 31Initiation of a BCMS implementation

In the context of initiating a BCMS, what is the primary role of the executive sponsor?

  1. Writing the recovery procedures
  2. Providing authority, resources and visible leadership Correct answer.
  3. Performing the business impact analysis
  4. Conducting internal audits of the BCMS

Explanation

The sponsor provides authority, secures resources and demonstrates leadership, which is essential for cross-functional BCMS work. Analytical and procedural tasks are delegated to the BC manager and business units.

Question 32Initiation of a BCMS implementation

An organization is defining the scope of its new BCMS. Which input is most directly relevant to that decision?

  1. The training records of the recovery teams
  2. The results of the risk assessment for suppliers
  3. The audit findings from the previous financial year
  4. The list of legal and regulatory obligations and the products and services offered Correct answer.

Explanation

Scope definition considers the organization's context, including its obligations and the products and services it delivers. The other items are outputs or activities that follow once scope is set.

Question 33Initiation of a BCMS implementation

Which statement best describes the purpose of a business continuity policy at the initiation stage?

  1. It lists the names of all recovery team members
  2. It sets the organization's commitment, objectives and direction for continuity Correct answer.
  3. It records the detailed recovery steps for each critical activity
  4. It provides the schedule of internal audits

Explanation

The BC policy is a top-level statement of commitment, intent and direction that frames the BCMS. Detailed procedures, team rosters and audit schedules are separate documents produced later.

Question 34Initiation of a BCMS implementation

What does 'context of the organization' mean when initiating a BCMS?

  1. The physical layout of the organization's buildings
  2. The number of staff employed in each department
  3. The software tools used to store continuity plans
  4. The internal and external issues, interested parties and obligations that affect the BCMS Correct answer.

Explanation

Context covers internal and external issues, interested parties and their requirements, and legal and regulatory obligations that shape the BCMS. Physical layout, tools and headcount are narrower inputs that may inform but do not define the context.

Question 35Initiation of a BCMS implementation

A newly appointed BC manager needs to identify interested parties relevant to the BCMS. Which group is an example of an external interested party?

  1. The recovery team coordinator
  2. A key regulatory authority Correct answer.
  3. The internal audit function
  4. The board of directors

Explanation

Interested parties include external bodies such as regulators, customers and suppliers, as well as internal groups. The board, internal audit and recovery teams are internal to the organization.

Question 36Initiation of a BCMS implementation

During initiation, top management sets business continuity objectives. Which characteristic makes an objective suitable for a BCMS?

  1. It is kept confidential from staff
  2. It is reviewed only at the end of the certification cycle
  3. It is expressed only in financial terms
  4. It is measurable and consistent with the BC policy Correct answer.

Explanation

Objectives should be measurable, monitored and consistent with the policy so progress can be evaluated. Confidentiality, infrequent review and purely financial framing do not meet the intent of setting meaningful continuity objectives.

Question 37Initiation of a BCMS implementation

What is the main purpose of conducting a gap analysis at the start of a BCMS implementation?

  1. To calculate the financial loss from a past incident
  2. To appoint the members of the recovery teams
  3. To select the software for plan management
  4. To compare current continuity capabilities against the requirements of the standard Correct answer.

Explanation

A gap analysis compares the organization's existing arrangements with the standard's requirements to identify what must be built or improved. It is a planning input, not a financial calculation or resourcing decision.

Question 38Initiation of a BCMS implementation

An organization has existing incident response plans but no formal management system. What does the gap analysis most likely reveal?

  1. That elements such as governance, objectives and continual improvement are missing Correct answer.
  2. That no further work is needed because plans exist
  3. That certification is automatically granted
  4. That the existing plans must be discarded entirely

Explanation

Having plans does not equal having a management system; the gap analysis typically shows missing governance, objectives, monitoring and improvement mechanisms. Existing plans are usually retained and integrated rather than discarded.

Question 39Initiation of a BCMS implementation

Which activity best represents establishing the 'framework' for a BCMS during initiation?

  1. Publishing the annual financial report
  2. Negotiating insurance premiums
  3. Defining roles, responsibilities, governance structure and documentation approach Correct answer.
  4. Executing a full failover test of the data centre

Explanation

The framework covers governance, roles and responsibilities, and the documentation structure that will support the BCMS. Testing, insurance and financial reporting are separate activities outside the framework's establishment.

Question 40Initiation of a BCMS implementation

Who should approve the business continuity policy for the BCMS to be credible?

  1. The BC manager alone
  2. The IT operations team
  3. Top management Correct answer.
  4. The external auditor

Explanation

Top management approval demonstrates commitment and gives the policy authority across the organization. The BC manager drafts, auditors assess and IT implements, but none of these confers organizational authority.

Question 41Initiation of a BCMS implementation

Which is the most appropriate first step when planning the BCMS implementation schedule?

  1. Identifying the activities, dependencies, resources and milestones needed Correct answer.
  2. Booking the certification audit date
  3. Writing all recovery procedures in full
  4. Selecting the recovery site vendor

Explanation

Implementation planning starts by identifying the activities, their dependencies, required resources and milestones so the schedule is realistic. Booking audits or drafting detailed outputs before planning leads to rework.

Question 42Initiation of a BCMS implementation

What is the primary reason to secure a budget and resources before implementation begins?

  1. To prevent staff from taking leave
  2. To ensure the BCMS has the people, time and tools needed to deliver its activities Correct answer.
  3. To satisfy the external auditor's personal preference
  4. To avoid the need for a business impact analysis

Explanation

Implementation requires people, time and tools; without committed resources the activities cannot be delivered. Resource commitment does not replace analysis nor serve auditor preference.

Question 43Initiation of a BCMS implementation

When identifying the BCMS scope, an organization decides to exclude a subsidiary. What should the justification for the exclusion be?

  1. The subsidiary is profitable
  2. The exclusion is documented and does not undermine the organization's ability to meet continuity obligations Correct answer.
  3. The subsidiary is located in a different city
  4. The subsidiary has the newest equipment

Explanation

Exclusions must be justified and documented, and must not compromise the BCMS's ability to meet the organization's continuity requirements. Profitability, equipment age and location are not valid bases for exclusion.

Question 44Initiation of a BCMS implementation

Which output most directly results from defining the BCMS scope and context?

  1. The list of corrective actions
  2. The completed business impact analysis
  3. The certified audit report
  4. The set of activities, locations and interfaces the BCMS will cover Correct answer.

Explanation

Defining scope and context produces the boundary of the BCMS, identifying which activities, locations and interfaces are covered. The BIA, audit report and corrective actions come later in the lifecycle.

Question 45Initiation of a BCMS implementation

What does 'leadership commitment' require from top management when initiating a BCMS?

  1. Attending recovery tests once a year
  2. Delegating all continuity decisions to the IT department
  3. Approving only the final audit report
  4. Actively directing and supporting the BCMS and holding people accountable Correct answer.

Explanation

Leadership commitment means top management actively directs and supports the BCMS, integrates it into business processes and holds people accountable. Delegation of all decisions or minimal involvement falls short.

Question 46Initiation of a BCMS implementation

Which document typically defines who is accountable for the BCMS and how it is governed across the organization?

  1. The training attendance sheet
  2. The business continuity policy and associated governance terms of reference Correct answer.
  3. The disaster recovery runbook
  4. The supplier contract register

Explanation

The policy and governance terms of reference set out accountability and the governance arrangements for the BCMS. Runbooks, contracts and attendance records serve operational or administrative purposes.

Question 47Initiation of a BCMS implementation

An organization is choosing the initial BCMS team. Which combination best supports the initiation phase?

  1. Only external consultants
  2. Only the finance department
  3. Only the marketing team
  4. A cross-functional group including business, IT, facilities and a coordinator Correct answer.

Explanation

A cross-functional team brings the perspectives needed to scope the BCMS and plan for all activities. Single-function or fully outsourced teams lack the internal knowledge required.

Question 48Initiation of a BCMS implementation

What is the relationship between the BCMS scope and the business impact analysis?

  1. The scope defines which activities the BIA will analyze Correct answer.
  2. The BIA defines the scope
  3. They are unrelated activities
  4. The BIA replaces the scope statement

Explanation

The scope sets the boundary, and the BIA analyzes the activities within that boundary. The scope is defined first, and the BIA does not replace it.

Question 49Initiation of a BCMS implementation

When initiating a BCMS, why is it important to identify legal, regulatory and contractual continuity requirements early?

  1. They shape scope, objectives and the obligations the BCMS must satisfy Correct answer.
  2. They guarantee certification on the first attempt
  3. They eliminate the need for a risk assessment
  4. They remove the need for management review

Explanation

Identifying obligations early ensures the scope, objectives and design of the BCMS account for what the organization must comply with. They do not remove other required activities such as risk assessment or management review.

Question 50Initiation of a BCMS implementation

Which action best demonstrates that top management has integrated the BCMS into the organization's business processes at initiation?

  1. Assigning the BCMS to a single part-time volunteer
  2. Storing the policy in a locked cabinet
  3. Aligning continuity objectives with strategic and operational planning Correct answer.
  4. Waiting for the first incident to test the system

Explanation

Integration means the BCMS is embedded in strategic and operational planning so continuity becomes part of how the organization runs. Isolation, minimal resourcing and reactive testing indicate a lack of integration.