CRISC Information Technology and Security Practice Question
A risk practitioner is documenting how the organization handles the risk that a critical SaaS vendor could suffer an outage that halts order processing. The vendor publishes a 99.9% uptime commitment and will credit service fees if it is missed. Which action BEST addresses the residual business impact that the credit does not cover?
⚠ Common exam trap
The trap here is treating a service-level credit or a higher uptime target as mitigation, when neither restores business operations during an actual outage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Maintain a documented business continuity plan with a manual order-processing fallback and periodic testing.
Because service credits only refund fees and cannot restore lost orders, the organization retains the operational impact of a vendor outage. A documented and tested business continuity plan with a manual fallback directly reduces that impact by keeping order processing alive, whereas contract changes, assurance reports, and insurance all leave the business unable to operate during the outage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Renegotiate the service level agreement to raise the uptime commitment to 99.99%.
Why it's wrong here
A higher uptime target reduces the frequency of outages but does not eliminate them, and the vendor still cannot guarantee zero downtime. When an outage occurs, the organization has no fallback, so the business impact is unchanged; this choice improves a contractual metric rather than building the capability to keep processing orders.
- ✗
Increase the cyber insurance limit to cover business interruption losses from vendor outages.
Why it's wrong here
Insurance can reimburse some financial loss after the fact, but it does not restore order processing while the outage continues, and contingent business interruption coverage often has waiting periods and sublimits. The operational gap remains, so this option transfers a portion of impact without providing the continuity capability the scenario calls for.
- ✓
Maintain a documented business continuity plan with a manual order-processing fallback and periodic testing.
Why this is correct
Service credits compensate fees, not lost revenue, customer defection, or regulatory deadlines, so the residual impact of a prolonged order-processing halt remains with the organization. A tested manual fallback with defined recovery time objectives keeps orders flowing during an outage and demonstrates that continuity risk has been actively treated rather than merely acknowledged in the vendor contract.
- ✗
Request the vendor's SOC 2 Type II report and file it with the vendor risk assessment.
Why it's wrong here
A SOC 2 report provides assurance over the vendor's control environment but does not create a recovery capability for the customer. Reading it may inform the risk rating, yet during an actual SaaS outage the organization would still be unable to process orders, so this evidence-gathering step leaves the residual business impact unaddressed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.