Certified Information Systems Auditor (CISA) — Question 279

Invoking a business continuity plan (BCP) is demonstrating which type of control?

Answer options

• A. Preventive
• B. Corrective
• C. Directive
• D. Detective

Correct answer: B

Explanation

Activating a business continuity plan (BCP) is a corrective action aimed at restoring operations after a disruption. Preventive controls are designed to stop incidents before they occur, directive controls guide actions, and detective controls identify incidents after they happen, making them unsuitable in this context.