How to Determine Application Resilience Requirements?

CISM By islever Editorial Last updated

Short answer

C A business impact analysis (BIA) identifies critical impacts to define resilience needs.

Question

The resilience requirements of an application are BEST determined by:
  1. a cost-benefit analysis.
  2. a threat assessment.
  3. a business impact analysis (BIA). Correct Answer
  4. a risk assessment.

Key Takeaways

This question tests the link between business impact and technical resilience, where the trap is selecting risk assessment instead of impact analysis.

Resilience requirements are established by understanding the consequences of downtime, making Business Impact Analysis (BIA) the primary method. Community consensus confirms that BIA is essential for defining recovery needs.

Common mistake: Selecting Risk Assessment (D) is a common error because while it identifies threats, BIA is required to quantify the specific downtime tolerance needed for resilience.

Expert Analysis

Why the Answer Is Correct

A Business Impact Analysis (BIA) is the specific process used to identify critical business functions and quantify the impact of a disruption. By determining the maximum tolerable downtime (MTD) and recovery time objectives (RTO), the BIA directly dictates the necessary resilience levels, such as failover capabilities and data redundancy. As noted in community comments, understanding the impact of data loss or downtime is the prerequisite for establishing these technical requirements.

Why the Other Options Are Wrong

A cost-benefit analysis (A) evaluates financial feasibility but does not determine the business need for resilience. A threat assessment (B) identifies potential adversaries or events but does not measure the operational impact of their success. A risk assessment (D) combines likelihood and impact to prioritize risks, but the specific requirements for resilience are derived from the impact component (BIA), not the overall risk calculation.

Community Comment Notes

The community strongly supports option C, with 100% of votes agreeing that BIA is the correct approach. Comments highlight that BIA focuses on understanding the consequences of disruption, which is the logical basis for defining resilience parameters like redundancy and disaster recovery plans.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

Focus on the 'Business' aspect of Business Impact Analysis; it translates business needs into technical requirements like RTO and RPO.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. sausageman 👍 2 Answered C
    C - BIA BIA helps understanding the business impact of application downtime or data loss, you can establish the necessary resilience requirements, such as redundancy, failover mechanisms, and disaster recovery plans.
  2. koala_lay 👍 1 Answered C
    A business impact analysis (BIA) is the process of identifying and evaluating the potential impacts of a disruption to business operations. The BIA focuses on understanding the critical business functions, the resources required to support those functions, and the consequences of a disruption. This information is then used to determine the appropriate resilience requirements for the application. The other options are not as effective for determining the resilience requirements of an application.
  3. 1899f17 👍 1
    Should be D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Best Defense Against DDoS Attacks in Enterprise Networks?

S-grade

When Should a Business Continuity Plan Be Primarily Triggered?

S-grade

Which Approach Best Communicates Security to Senior Management?

S-grade

How to Keep a Business Continuity Plan Current?

S-grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide