Certified in Risk and Information Systems Control (CRISC) — Question 119

Which of the following should an organization perform to forecast the effects of a disaster?

Answer options

• A. Analyze capability maturity model gaps.
• B. Define recovery time objectives (RTOs).
• C. Develop a business impact analysis (BIA).
• D. Simulate a disaster recovery.

Correct answer: C

Explanation

The correct answer is C because a business impact analysis (BIA) helps an organization understand the potential effects of a disaster on its operations. Option A focuses on assessing maturity gaps, which is not directly related to forecasting disaster impacts. Option B is important for recovery planning but does not directly address forecasting effects, and option D involves testing recovery plans rather than predicting impacts.