Which of the following is a critical first step in disaster recovery and contingency planning?

A.
Plan testing and drills.

B.
Complete a business impact analysis.

C.
Determine offsite backup facility alternatives.

D.
Organize and create relevant documentation.

Explanation:
B: Of the steps listed in this question, completing a business impact analysis would take the highest priority. The BIA is essential in determining the most critical business functions
and identifying the threats that correlate them. Qualitative and quantitative data needs to be gathered, analyzed, interpreted, and presented to management.
A is incorrect because plan testing and drills are the last step in disaster recovery and contingency planning. It is important to test the business continuity plan regularly because
environments continually change. Tests and disaster recovery drills and exercises should be performed at least once a year. Most companies cannot afford for these exercises to
interrupt production or productivity, so the exercises may need to take place in sections or at specific times, which requires logistical planning.
C is incorrect because determining offsite backup facility alternatives is part of the recovery strategy, which takes place in the middle of the disaster recovery and contingency
planning process. Organizations must have alternative offsite backup facilities in the case of a larger disaster. Generally, contracts are established with third-party vendors to provide
such services. The client pays a monthly fee to retain the right to use the facility in a time of need, and then incurs an activation fee when the facility has to be used.
D is incorrect because organizing and creating relevant documentation takes place toward the end of the disaster recovery and contingency planning process. Procedures need to
be documented because when they are actually needed, it will most likely be a chaotic and frantic atmosphere with a demanding time schedule. The documentation may need to
include information on how to install images, configure operating systems and servers, and properly install utilities and proprietary software. Other documentation could include a
calling tree, and contact information for specific vendors, emergency agencies, offsite facilities, etc.