Business Continuity and Awareness
Domain 6 - Business Continuity and Awareness
This domain tests resilience planning and human-risk reduction. Expect questions on business impact analysis, recovery objectives, disaster recovery strategies, exercises, and security awareness.
Core rules and concepts
- A business impact analysis identifies critical services, dependencies, and maximum tolerable downtime. From it derive recovery time objectives (RTO) and recovery point objectives (RPO).
- Continuity is broader than IT disaster recovery: it includes people, facilities, suppliers, and manual workarounds. Choose strategies (hot/warm/cold sites, cloud failover, alternate suppliers) based on cost versus outage impact.
- Exercise plans at increasing maturity: tabletop, component failover, full simulation. Record gaps and track remediation.
- Awareness programs target risky behaviors, not annual completion. Use role-based training, phishing simulations with coaching, and metrics such as report rate and click rate over time.
Worked example
Payroll is due in five days. The BIA sets an RTO of 48 hours and an RPO of four hours because employees must be paid. The team selects a warm cloud standby with four-hour replication, tests restoration quarterly, and documents a manual payroll workaround. During an exercise, restoration takes 60 hours, exceeding RTO. The gap is traced to undocumented database dependencies; remediation adds runbooks and a dependency map. Reasoning: RTO drives architecture and testing; an untested plan is an assumption.
Traps that cost marks
- Confusing RTO with RPO or setting them without a BIA.
- Treating disaster recovery as complete business continuity.
- Running awareness as a compliance checkbox with no behavior metrics.
- Assuming backups are recoverable without restore testing.