Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CISM Information Security Program Practice Question
Arrange the steps in order for conducting a business impact analysis (BIA) in business continuity management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identify critical business functions, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions, then document findings
A BIA first identifies critical functions, then determines acceptable downtime, assesses impact, prioritizes recovery, and finally documents findings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identify critical business functions, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions, then document findings
Why this is correct
This is correct because a BIA first identifies what is critical, then establishes the maximum tolerable outage, then evaluates the consequences, then ranks recovery priorities based on that analysis, and finally records the results.
- ✗
Identify critical business functions, then assess impact of disruptions, then determine acceptable downtime, then prioritize recovery of critical functions, then document findings
Why it's wrong here
This is incorrect because impact assessment should come after determining acceptable downtime. You need to know the allowable outage time before you can measure the actual impact of exceeding it.
- ✗
Identify critical business functions, then document findings, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions
Why it's wrong here
This is incorrect because documentation is the final step. Performing it early means you would document incomplete or preliminary information, and you cannot properly assess downtime or impact before documenting.
- ✗
Document findings, then prioritize recovery of critical functions, then assess impact of disruptions, then determine acceptable downtime, then identify critical business functions
Why it's wrong here
This is incorrect because it reverses the entire process. A BIA must start by identifying critical functions and end with documentation; you cannot document or prioritize before you know what is critical and what the impacts are.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.