CRISC Question 251

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  RTOs are part of DRP not BCP. The question specifically said BCP review, so answer is B

• 1

  The question is "When reviewing a BCP" not "When evaluating the result of a DRP" Key Words reviewing and deficiency Selected Answer: B BCP and DRP often seem interdependent. While the two concepts differ, they overlap in some areas and work best when developed in tandem.

• Chose D1

  of the options provided, the MOST significant deficiency when reviewing a business continuity plan (BCP) would be if the recovery time objectives (RTOs) do not meet business requirements. RTOs define the maximum acceptable time a process or system can be down before causing significant impacts to the business. If RTOs are not aligned with business needs, it can lead to extended downtime, loss of revenue, customer dissatisfaction, and potential operational disruptions during a disaster or incident. While the other options (A, B, and C) could also represent deficiencies in the BCP, the misalignment of RTOs with business requirements has the potential for more serious consequences as it directly impacts the organization's ability to recover critical functions within an acceptable timeframe. For specific ISACA references and detailed guidance, I recommend consulting ISACA's official documentation on business continuity planning and IT risk management.