Which of the following processes is critical for deciding prioritization of actions in a business
continuity plan?

A.
Business impact analysis (BIA)

B.
Risk assessment

C.
Vulnerability assessment

D.
Business process mapping

Explanation:

A business impact analysis (BIA) provides results, such as impact from a security incident and
required response times. The BIA is the most critical process for deciding which part of the
information system/ business process should be given prioritization in case of a security incident.
Risk assessment is a very important process for the creation of a business continuity plan. Risk
assessment provides information on the likelihood of occurrence of security incidence and assists
in the selection of countermeasures. but not in the prioritization. As in choice B, a vulnerability
assessment provides information regarding the security weaknesses of the system, supporting the
risk analysis process. Business process mapping facilitates the creation of the plan by providing
mapping guidance on actions after the decision on critical business processes has been madetranslating business prioritization to IT prioritization. Business process mapping does not help in
making a decision, but in implementing a decision.