Study. uk . com
  1. Home
  2. All questions
  3. Question 137

CISSP study material · question 137 of 500

A project team plans to conduct its business impact analysis after the system goes live, when real usage data will be available. What does NIST SP 800-34 recommend instead?

  1. Perform it at disposal, to inform the successor system's plan.
  2. Perform it during initiation, and repeat it during development or acquisition if the design changes.
  3. Perform it only after the first disruption, so impacts are measured rather than estimated.
  4. Perform it during operations, once a full year of availability data exists.
Show the answer

Answer: B. Perform it during initiation, and repeat it during development or acquisition if the design changes.

The business impact analysis belongs in the initiation phase, and may need to be conducted again during development or acquisition as the design and components change.

Source: NIST SP 800-34 Rev. 1 (NIST) — SP 800-34 Rev. 1 > 3.2 Conduct the Business Impact Analysis

Challenge yourself on this topic → Study as cards