Which Plan Best Prepares an Organization to Recover from Disaster-Related Revenue Loss?
Short answer
D Implement a business continuity plan to maintain critical operations and recover revenue after a disaster.
Question
Key Takeaways
Tests the difference between IT-focused recovery (DRP) and business-process recovery (BCP), with candidates often confusing BIA as a recovery strategy rather than a preparatory assessment.
This CISM question tests the distinction between BIA, DRP, and BCP for organizational recovery. Community consensus strongly supports BCP as the best choice for minimizing revenue loss and ensuring business recovery.
Common mistake: Option C (DRP) is frequently chosen because it explicitly mentions 'recovery,' but DRP only covers IT infrastructure restoration, whereas BCP addresses overall business operations and revenue protection.
Expert Analysis
Why the Answer Is Correct
A Business Continuity Plan (BCP) directly addresses the preservation of critical business functions and revenue streams during and after a disruption. Unlike purely technical responses, BCP translates risk assessments into actionable strategies that keep the organization operational. This aligns with ISACA's emphasis on maintaining service levels and financial stability during crises.
Why the Other Options Are Wrong
A Business Impact Analysis (BIA) is strictly an assessment tool that identifies critical processes and potential financial impacts; it does not prescribe recovery actions or strategies. A Disaster Recovery Plan (DRP) focuses exclusively on restoring IT systems, networks, and data, which is too narrow for broader revenue loss scenarios. An Incident Response Plan targets security breaches and cyber threats rather than comprehensive disaster recovery for business continuity.
Community Comment Notes
Multiple contributors highlight that BIA serves only as a foundational step to inform planning, not as a recovery mechanism itself [1]. Several users emphasize that BCP's core objective is sustaining critical services and enabling full organizational recovery, which directly mitigates revenue loss [3][4]. The consensus reinforces that exam questions prioritizing business operations over IT restoration require selecting BCP.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When answering CISM questions involving 'recovery' and 'business operations,' always prioritize BCP over DRP unless the scenario strictly limits the scope to IT infrastructure restoration. Focus on the business outcome (e.g., revenue, service levels) rather than technical restoration steps to align with ISACA's management-level perspective.
Frequently Asked Questions
Why is BIA not the correct answer for disaster recovery?
How does DRP differ from BCP in CISM exams?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
helg420 👍 3 Answered DBIA is a preparatory step that identifies which business processes are essential, their dependencies and the potential impact of a disruption to those processes. The BIA itself does not include strategies or actions for recovery. In contrast, a BCP uses the insights gained from a BIA to develop plans to ensure the business can continue operating during and recover after a disaster. In this scenario, a BCP would have been most helpful.
-
Josef4CISM 👍 1 Answered CWhy on earth people choose BCP? The purpose of a BCP is to keep the business running in a disaster. The main focus point of a BCP is NOT the recovery of the business, but the maintenance of critical business services. Instead, the DRP intends to recover the business services to a normal state. Why else there is RECOVERY in DRP? You could argue for option A - BIA, since a BIA is the pre-requisite for DRP and for BCP's (e.g., you determine main recovery targets like RTO, RPO etc.). But the question clearly asks about the recovery of the business, hence I go for option C.
-
shootnot 👍 1D- If the business had BCP in place they would have not faced this loss. Option A- What is important. Option B- How to do Option C- What to do. Option D- How to keep the business running
-
afoo1314 👍 2 Answered DBIA is part of designing BCP.
-
ssdny 👍 1 Answered AI go A
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISM Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISM Practice Test →