Which of the following provides enterprise management with a prioritized list of time-critical business
processes, and estimates a recovery time objective for each of the time critical processes and the components
of the enterprise that support those processes?

A.
Business Impact Assessment

B.
Current State Assessment

C.
Risk Mitigation Assessment.

D.
Business Risk Assessment.

Explanation:
A Business Impact Assessment (BIA) is an analysis that identifies the resources that are critical to an
organization’s ongoing viability and the threats posed to those resources. It also assesses the likelihood that
each threat will actually occur and the impact those occurrences will have on the business. Identification of
priorities is the first step of the business impact assessment process.
Incorrect Answers:
B: Current State Assessment is related to future business planning needs. It is concerned with recovery time of
critical business processes.
C: Risk Mitigation Assessment is concerned with recovery time objectives. The Business Impact Assessment
addresses the recovery time.
D: Business Risk Assessment is concerned with recovery time objectives. The Business Impact Assessment
addresses the recovery time.

Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional
Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 825