Certified Information Security Manager (CISM) — Question 375

Which of the following documents should contain the INITIAL prioritization of recovery of services?

Answer options

• A. Threat assessment
• B. IT risk analysis
• C. Business impact analysis (BIA)
• D. Business process map

Correct answer: C

Explanation

The correct answer is C, as the Business Impact Analysis (BIA) specifically focuses on identifying critical services and prioritizing their recovery based on the impact of their disruption. The other options, while important for overall risk management and understanding threats, do not specifically address the prioritization of recovery services.