Which Plan Best Prepares an Organization to Recover from Disaster-Related Revenue Loss?

Business Continuity Planning
Answer Correct answer: D — Implement a business continuity plan to maintain critical operations and recover revenue after a disaster.

An organization experienced a loss of revenue during a recent disaster. Which of the following would BEST prepare the organization to recover?

  1. Business impact analysis (BIA)
  2. Incident response plan
  3. Disaster recovery plan (DRP)
  4. Business continuity plan (BCP) Correct Answer
business continuity plan vs drp cism disaster recovery question business impact analysis vs bcp

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the difference between IT-focused recovery (DRP) and business-process recovery (BCP), with candidates often confusing BIA as a recovery strategy rather than a preparatory assessment.

This CISM question tests the distinction between BIA, DRP, and BCP for organizational recovery. Community consensus strongly supports BCP as the best choice for minimizing revenue loss and ensuring business recovery.

Option C (DRP) is frequently chosen because it explicitly mentions 'recovery,' but DRP only covers IT infrastructure restoration, whereas BCP addresses overall business operations and revenue protection.

Community Discussion (5 comments)

Josef4CISM 👍 1 Selected: C
Why on earth people choose BCP? The purpose of a BCP is to keep the business running in a disaster. The main focus point of a BCP is NOT the recovery of the business, but the maintenance of critical business services. Instead, the DRP intends to recover the business services to a normal state. Why else there is RECOVERY in DRP? You could argue for option A - BIA, since a BIA is the pre-requisite for DRP and for BCP's (e.g., you determine main recovery targets like RTO, RPO etc.). But the question clearly asks about the recovery of the business, hence I go for option C.
helg420 👍 3 Selected: D
BIA is a preparatory step that identifies which business processes are essential, their dependencies and the potential impact of a disruption to those processes. The BIA itself does not include strategies or actions for recovery. In contrast, a BCP uses the insights gained from a BIA to develop plans to ensure the business can continue operating during and recover after a disaster. In this scenario, a BCP would have been most helpful.
afoo1314 👍 2 Selected: D
BIA is part of designing BCP.
shootnot 👍 1
D- If the business had BCP in place they would have not faced this loss. Option A- What is important. Option B- How to do Option C- What to do. Option D- How to keep the business running
ssdny 👍 1 Selected: A
I go A

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

A Business Continuity Plan (BCP) directly addresses the preservation of critical business functions and revenue streams during and after a disruption. Unlike purely technical responses, BCP translates risk assessments into actionable strategies that keep the organization operational. This aligns with ISACA's emphasis on maintaining service levels and financial stability during crises.

Why the Other Options Are Wrong

A Business Impact Analysis (BIA) is strictly an assessment tool that identifies critical processes and potential financial impacts; it does not prescribe recovery actions or strategies. A Disaster Recovery Plan (DRP) focuses exclusively on restoring IT systems, networks, and data, which is too narrow for broader revenue loss scenarios. An Incident Response Plan targets security breaches and cyber threats rather than comprehensive disaster recovery for business continuity.

Community Comment Notes

Multiple contributors highlight that BIA serves only as a foundational step to inform planning, not as a recovery mechanism itself [1]. Several users emphasize that BCP's core objective is sustaining critical services and enabling full organizational recovery, which directly mitigates revenue loss [3][4]. The consensus reinforces that exam questions prioritizing business operations over IT restoration require selecting BCP.

Official Reference

Exam Strategy

When answering CISM questions involving 'recovery' and 'business operations,' always prioritize BCP over DRP unless the scenario strictly limits the scope to IT infrastructure restoration. Focus on the business outcome (e.g., revenue, service levels) rather than technical restoration steps to align with ISACA's management-level perspective.

Frequently Asked Questions

Why is BIA not the correct answer for disaster recovery?

BIA only identifies critical processes and potential impacts; it does not contain actionable recovery strategies or plans.

How does DRP differ from BCP in CISM exams?

DRP focuses on restoring IT systems and data, while BCP addresses broader business functions and revenue protection during disruptions.

Related Analysis

Communicating which of the following would be MOST helpful t

A-Grade

Which of the following will have the GREATEST impact on the

A-Grade

Which of the following is the BEST indication that an inform

S-Grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide