When Should a Business Continuity Plan Be Primarily Triggered?

Answer Correct answer: D — Authorized management must formally direct the activation of the business continuity plan following a disruptive event.

When an organization experiences a disruptive event, the business continuity plan (BCP) should be triggered PRIMARILY based on:

expected duration of outage.
the root cause of the event.
type of security incident.
management direction. Correct Answer

business continuity plan activation cism bcp trigger management direction bcp disruptive event response

Community Votes

57%

43%

57% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the distinction between technical recovery criteria and executive authorization, with candidates frequently mistaking outage duration for the actual activation trigger.

This CISM question evaluates the primary trigger for activating a Business Continuity Plan during a disruptive event. While technical metrics guide recovery efforts, ISACA governance principles mandate that formal management direction serves as the definitive activation trigger.

Option A is commonly selected because outage duration directly correlates with Recovery Time Objectives, yet duration alone lacks the organizational authority required to initiate enterprise-wide continuity operations.

Community Discussion (6 comments)

hargit 👍 4 Selected: A

The business continuity plan (BCP) should be triggered primarily based on the expected duration of outage (Option A). This approach ensures that the organization can respond promptly to minimize downtime and maintain critical operations

Josef4CISM 👍 1 Selected: C

Type of security incident. This comes with the assumption that the severity of incident is meant.

1899f17 👍 2

C. type of security incident.

helg420 👍 2 Selected: D

i agree with D. Incident response procedures should dictate the process to enact BCP and thats usually at management discretion. the expected duration will be just one of the many variables to consider

shootnot 👍 4

A- Why not D, because Management direction or decision to activate BCP will be based on some criteria which is primarily 'A'. Why not 'C', because BCP could be non-security event based trigger as well.

ssdny 👍 1 Selected: D

I think D

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

ISACA emphasizes that activating a Business Continuity Plan carries significant financial, legal, and operational consequences. Consequently, the plan must be triggered primarily through formal management direction or executive declaration. Predefined criteria such as severity or duration inform this decision, but the authoritative command to mobilize resources rests solely with designated leadership.

Why the Other Options Are Wrong

Expected duration (A) serves as a critical metric for determining Recovery Time Objectives, but it functions as an input variable rather than the activation authority. Root cause (B) and incident type (C) are investigative factors used during incident response, not triggers for enterprise-wide continuity planning. Furthermore, BCPs address non-security disruptions like natural disasters, making security-specific options too narrow.

Community Comment Notes

Several candidates debated Option A versus Option D, highlighting a common real-world versus exam scenario gap. Comment 2 correctly notes that management decisions rely on criteria like outage duration, but clarifies that the directive itself remains the formal trigger. Comment 3 reinforces that incident response procedures ultimately defer to management discretion for BCP enactment, aligning with ISACA’s governance-focused methodology.

Official Reference

Exam Strategy

Always prioritize governance and decision authority over technical metrics in CISM scenarios. When evaluating BCP or DRP triggers, identify who holds the organizational mandate to execute the plan rather than focusing solely on operational thresholds.

Frequently Asked Questions

Why isn't expected outage duration the primary trigger?

Duration informs recovery time objectives, but BCP activation requires formal executive authorization to mobilize organization-wide resources and declare a disaster.

Does BCP only cover security incidents?

No, business continuity plans address all disruptive events including natural disasters, utility failures, and supply chain interruptions, not just security breaches.

Related Analysis

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide