easyMultiple Choice
Business Impact Analysis Primary Purpose for CISSP
Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in business continuity planning?
Quick Answer
The answer is to identify critical business functions and dependencies. This is the primary purpose of a business impact analysis (BIA) because it systematically quantifies the operational and financial impacts of disruptions, establishing which processes must be restored first and what resources—such as personnel, systems, data, and third-party services—they rely on. On the CISSP exam, this concept tests your understanding that the BIA drives all subsequent continuity planning by providing empirical data for recovery time objectives (RTOs) and recovery point objectives (RPOs), rather than relying on assumptions. A common trap is confusing the BIA with a risk assessment; remember that the BIA focuses on business process priorities and dependencies, not on threat likelihood. Memory tip: BIA stands for “Business Impact Analysis” but think of it as “Before Implementing Anything”—it must come first to reveal what truly matters to the organization.
⚠ Common exam trap
Many candidates confuse the BIA's primary purpose with its outputs (RTO/RPO), but the BIA is fundamentally about identifying what is critical and why, not setting the numerical targets themselves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identify critical business functions and dependencies
The primary purpose of a business impact analysis (BIA) is to identify critical business functions and their dependencies on resources such as personnel, systems, data, and third-party services. This identification drives all subsequent continuity planning by quantifying the impact of disruptions and establishing the basis for recovery strategies. Without a BIA, recovery objectives and plans would be based on assumptions rather than empirical data about operational priorities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identify critical business functions and dependencies
Why this is correct
A BIA determines which business functions are essential and how their loss affects the organisation, plus their dependencies and recovery priorities. That identification of critical functions and dependencies is the foundation for subsequent continuity and recovery strategies.
- ✗
Develop and test the continuity plan
Why it's wrong here
Developing and testing the continuity plan occurs after the BIA has identified critical functions and impact tolerances; the BIA itself gathers impact data rather than producing or exercising the plan. Testing is tempting because it validates continuity arrangements, but it consumes BIA outputs instead of being the BIA's purpose.
- ✗
Determine recovery time objectives (RTO) and recovery point objectives (RPO)
Why it's wrong here
A BIA identifies critical business processes and the impact of their disruption over time; RTO and RPO values are derived from that impact analysis, not its primary purpose. Determining these objectives is tempting because they emerge from BIA findings, but they are outputs of the wider continuity process.
- ✗
Create the business continuity plan document
Why it's wrong here
A BIA identifies critical business functions and quantifies the impact of their disruption, feeding RTO and RPO data into planning; writing the continuity plan document is a later deliverable built from that analysis. Document creation is tempting because it is the visible output, but it follows the BIA rather than being its purpose.
Go deeper
Related to this question
Learn chapter
Disaster Recovery Planning
Key term
Business impact analysis
A systematic process used to identify and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency.
Key term
Identification
Identification is the process where a user or device claims an identity, often by providing a username, ID number, or account name, before proving that claim with authentication.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISSP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are valid reasons for conducting a business impact analysis (BIA)?
easy- A.To identify vulnerabilities in the network infrastructure
- B.To perform a full security audit of the organization
- C.To create a list of all hardware and software assets
- ✓ D.To identify critical business processes and their dependencies
- ✓ E.To determine the maximum acceptable outage time for each process
Why D: A Business Impact Analysis (BIA) is specifically designed to identify critical business processes and their dependencies on resources such as personnel, systems, and data. This identification is foundational for prioritizing recovery strategies in business continuity planning, as it directly links operational needs to technical infrastructure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.