ISC2 CSSLP Exam - Topic 5 Question 12 Discussion

A disaster recovery plan is a complete statement of reliable actions to be taken before, during, and after a disruptive event that causes a

considerable loss of information systems resources. The chief objective of a disaster recovery plan is to provide an organized way to make

decisions if a disruptive event occurs.

Disaster recovery planning is a subset of a larger process known as business continuity planning and should include planning for resumption

of applications, data, hardware, communications (such as networking), and other IT infrastructure. A business continuity plan (BCP) includes

planning for non-IT related aspects such as key personnel, facilities, crisis communication, and reputation protection, and should refer to the

disaster recovery plan (DRP) for IT-related infrastructure recovery/continuity.

Answer D is incorrect. Business Continuity Planning (BCP) is the creation and validation of a practiced logistical plan for how an

organization will recover and restore partially or completely interrupted critical (urgent) functions within a predetermined time after a disaster

or extended disruption. The logistical plan is called a business continuity plan.

Answer B is incorrect. The Continuity Of Operation Plan (COOP) refers to the preparations and institutions maintained by the United

States government, providing survival of federal government operations in the case of catastrophic events. It provides procedures and

capabilities to sustain an organization's essential. COOP is the procedure documented to ensure persistent critical operations throughout any

period where normal operations are unattainable.

Answer A is incorrect. A contingency plan is a plan devised for a specific situation when things could go wrong. Contingency plans are

often devised by governments or businesses who want to be prepared for anything that could happen. Contingency plans include specific

strategies and actions to deal with specific variances to assumptions resulting in a particular problem, emergency, or state of affairs. They also

include a monitoring process and 'triggers' for initiating planned actions. They are required to help governments, businesses, or individuals to

recover from serious incidents in the minimum time with minimum cost and disruption.