Management support is critical to the success of a business continuity plan. Which of the following is the most important to be provided to management to obtain their support?

A.
Business case

B.
Business impact analysis

C.
Risk analysis

D.
Threat report

Explanation:
A: The most critical part of establishing and maintaining a current continuity plan is management support. Management may need to be convinced of the necessity of such a plan.
Therefore, a business case must be made to obtain this support. The business case may include current vulnerabilities, regulatory and legal obligations, the current status of recovery
plans, and recommendations. Management is commonly most concerned with cost/benefit issues, so preliminary numbers can be gathered and potential losses estimated. The
decision of how a company should recover is a business decision and should always be treated as such.
B is incorrect because a business impact analysis (BIA) is conducted after the BCP team has obtained management’s support for their efforts. A BIA is performed to identify the
areas that would suffer the greatest financial or operational loss in the event of a disaster or disruption. It identifies the company’s critical systems needed for survival and estimates the
outage time that can be tolerated by the company as a result of a disaster or disruption.
C is incorrect because a risk analysis is a method of identifying risks and assessing the possible damage that could be caused in order to justify security safeguards. In the context
of BCP, risk analysis methodologies are used during a business impact analysis to establish which processes, devices, or operational activities are critical and should therefore be
recovered first.
D is incorrect because threat report is a distractor. However, it is critical that management understand what the real threats are to the company, the consequences of those threats,
and the potential loss values for each threat. Without this understanding, management may only give lip service to continuity planning, and in some cases that is worse than not having
any plans at all because of the false sense of security that it creates.