Study. uk . com
  1. Home
  2. All questions
  3. Question 141

CISSP study material · question 141 of 500

A business impact analysis shows that a single air-conditioning unit failing would take down a computer room within an hour. The team proposes documenting a recovery procedure for that outage. What does NIST SP 800-34 prefer?

  1. Raising the maximum tolerable downtime to cover the expected outage.
  2. A preventive control that removes or reduces the impact, where it is feasible and cost-effective.
  3. Transferring the risk to the facilities provider through a service agreement.
  4. A recovery procedure, since preventive controls sit outside contingency planning.
Show the answer

Answer: B. A preventive control that removes or reduces the impact, where it is feasible and cost-effective.

Where outage impacts found by the analysis can be reduced or removed by preventive measures, SP 800-34 prefers those measures to relying on recovery action after the event.

Source: NIST SP 800-34 Rev. 1 (NIST) — SP 800-34 Rev. 1 > 3.3 Identify Preventive Controls

Challenge yourself on this topic → Study as cards