When Should a Business Continuity Plan Be Primarily Triggered?

CISM By islever Editorial Last updated

Short answer

D Authorized management must formally direct the activation of the business continuity plan following a disruptive event.

Question

When an organization experiences a disruptive event, the business continuity plan (BCP) should be triggered PRIMARILY based on:
  1. expected duration of outage.
  2. the root cause of the event.
  3. type of security incident.
  4. management direction. Correct Answer

Key Takeaways

Tests the distinction between technical recovery criteria and executive authorization, with candidates frequently mistaking outage duration for the actual activation trigger.

This CISM question evaluates the primary trigger for activating a Business Continuity Plan during a disruptive event. While technical metrics guide recovery efforts, ISACA governance principles mandate that formal management direction serves as the definitive activation trigger.

Common mistake: Option A is commonly selected because outage duration directly correlates with Recovery Time Objectives, yet duration alone lacks the organizational authority required to initiate enterprise-wide continuity operations.

Expert Analysis

Why the Answer Is Correct

ISACA emphasizes that activating a Business Continuity Plan carries significant financial, legal, and operational consequences. Consequently, the plan must be triggered primarily through formal management direction or executive declaration. Predefined criteria such as severity or duration inform this decision, but the authoritative command to mobilize resources rests solely with designated leadership.

Why the Other Options Are Wrong

Expected duration (A) serves as a critical metric for determining Recovery Time Objectives, but it functions as an input variable rather than the activation authority. Root cause (B) and incident type (C) are investigative factors used during incident response, not triggers for enterprise-wide continuity planning. Furthermore, BCPs address non-security disruptions like natural disasters, making security-specific options too narrow.

Community Comment Notes

Several candidates debated Option A versus Option D, highlighting a common real-world versus exam scenario gap. Comment 2 correctly notes that management decisions rely on criteria like outage duration, but clarifies that the directive itself remains the formal trigger. Comment 3 reinforces that incident response procedures ultimately defer to management discretion for BCP enactment, aligning with ISACA’s governance-focused methodology.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always prioritize governance and decision authority over technical metrics in CISM scenarios. When evaluating BCP or DRP triggers, identify who holds the organizational mandate to execute the plan rather than focusing solely on operational thresholds.

Frequently Asked Questions

Why isn't expected outage duration the primary trigger?

Duration informs recovery time objectives, but BCP activation requires formal executive authorization to mobilize organization-wide resources and declare a disaster.

Does BCP only cover security incidents?

No, business continuity plans address all disruptive events including natural disasters, utility failures, and supply chain interruptions, not just security breaches.

More CISM FAQ →

Community Votes

A
57%
D
43%

57% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. hargit 👍 4 Answered A
    The business continuity plan (BCP) should be triggered primarily based on the expected duration of outage (Option A). This approach ensures that the organization can respond promptly to minimize downtime and maintain critical operations
  2. shootnot 👍 4
    A- Why not D, because Management direction or decision to activate BCP will be based on some criteria which is primarily 'A'. Why not 'C', because BCP could be non-security event based trigger as well.
  3. helg420 👍 2 Answered D
    i agree with D. Incident response procedures should dictate the process to enact BCP and thats usually at management discretion. the expected duration will be just one of the many variables to consider
  4. Josef4CISM 👍 1 Answered C
    Type of security incident. This comes with the assumption that the severity of incident is meant.
  5. 1899f17 👍 2
    C. type of security incident.
Show 1 more comment
  1. ssdny 👍 1 Answered D
    I think D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Best Defense Against DDoS Attacks in Enterprise Networks?

S-grade

Which Approach Best Communicates Security to Senior Management?

S-grade

How to Keep a Business Continuity Plan Current?

S-grade

How to Ensure Effective Execution of a Disaster Recovery Plan?

S-grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide