mediumMultiple SelectObjective-mapped
CISSP Practice Question: Is conducting a Business Impact Analysis (BIA) as…
An organization is conducting a Business Impact Analysis (BIA) as part of its business continuity planning. Which THREE of the following are essential components of a BIA? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Criticality prioritization
The correct options are A, B, and E. Recovery Time Objective (RTO) defines the target time to resume operations; Maximum Tolerable Downtime (MTD) defines the total allowable downtime; Criticality prioritization ranks processes by importance. Option C (Mean Time Between Failures) is a reliability metric, not used in BIA. Option D (Single point of failure identification) is part of vulnerability assessment, not a direct component of BIA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Criticality prioritization
Why this is correct
Criticality prioritization is a core activity within a Business Impact Analysis (BIA), where business processes and assets are systematically evaluated and ranked based on their importance to the organization's mission and the potential impact of their disruption. This ranking helps allocate recovery resources effectively, ensuring that the most vital functions receive immediate attention during a disruptive event. It directly informs the development of recovery strategies and objectives.
- ✓
Recovery Time Objective (RTO)
Why this is correct
The Recovery Time Objective (RTO) is a critical output derived from a Business Impact Analysis (BIA), representing the maximum acceptable duration that a business process or function can be unavailable following a disruption before unacceptable consequences occur. It quantifies the target time for restoration of service delivery to a specified level. The BIA determines RTOs by analyzing the impact over time for each critical process.
- ✗
Mean Time Between Failures (MTBF)
Why it's wrong here
Mean Time Between Failures (MTBF) is a reliability engineering metric that quantifies the average time a system or component operates without failure. While valuable for predicting hardware reliability and informing maintenance schedules, MTBF is not a direct component or output of a Business Impact Analysis. A BIA focuses on the *impact* of a disruption and recovery objectives, rather than the statistical likelihood of a component failing.
- ✗
Single point of failure identification
Why it's wrong here
Single point of failure (SPOF) identification involves pinpointing components or systems whose failure would cause an entire system or service to cease functioning. While crucial for overall resilience planning, SPOF identification is primarily an activity within a broader risk assessment or vulnerability analysis, rather than a direct component of a Business Impact Analysis. A BIA focuses on the *impact* of a disruption to business processes, not the specific technical causes of potential failures.
- ✓
Maximum Tolerable Downtime (MTD)
Why this is correct
Maximum Tolerable Downtime (MTD), also known as Maximum Tolerable Period of Disruption (MTPoD), defines the absolute longest period an organization can withstand the disruption of a specific business process or function before suffering irreparable harm or unacceptable consequences. The BIA establishes the MTD for each critical process by analyzing the cumulative impact over time. It serves as an upper limit for the Recovery Time Objective (RTO).
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Vulnerability assessment
A vulnerability assessment is a systematic review of security weaknesses in an information system, evaluating if the system is susceptible to any known vulnerabilities, assigning severity levels, and recommending remediation or mitigation.
Key term
MTD
MTD (Maximum Tolerable Downtime) is the longest period a business can function without a specific system or service before the damage becomes unacceptable.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.