Certified in Risk and Information Systems Control (CRISC) — Question 1355

Which of the following should be done FIRST when developing a business continuity plan (BCP)?

Answer options

• A. Identifying costs associated with continuity requirements
• B. Performing business impact analysis (BIA)
• C. Establishing recovery time objectives (RTOs)
• D. Identifying critical business functions

Correct answer: B

Explanation

The first step in developing a business continuity plan is to perform a business impact analysis (BIA), as it helps identify critical functions and the potential impact of disruptions. While identifying costs, setting recovery time objectives, and recognizing critical functions are important, they should be informed by the insights gained from the BIA.