To ensure that payroll systems continue on in an event of a hurricane hitting a data center, what
would be the FIRS T crucial step an information security manager would take in ensuring business

continuity planning?

A.
Conducting a qualitative and quantitative risk analysis.

B.
Assigning value to the assets.

C.
Weighing the cost of implementing the plan vs. financial loss.

D.
Conducting a business impact analysis (BIA).

Explanation:

BIA is an essential component of an organization’s business continuity plan; it includes an
exploratory component to reveal any vulnerabilities and a planning component to develop
strategies for minimizing risk. It is the first crucial step in business continuity planning. Qualitative
and quantitative risk analysis will have been completed to define the dangers to individuals,
businesses and government agencies posed by potential natural and human-caused adverse
events. Assigning value to assets is part of the BIA process. Weighing the cost of implementing
the plan vs. financial loss is another part of the BIA.