How to Determine Application Resilience Requirements?

Business Continuity Planning

Answer Correct answer: C — A business impact analysis (BIA) identifies critical impacts to define resilience needs.

The resilience requirements of an application are BEST determined by:

a cost-benefit analysis.
a threat assessment.
a business impact analysis (BIA). Correct Answer
a risk assessment.

business impact analysis resilience cism resilience requirements bia vs risk assessment application resilience bcp

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the link between business impact and technical resilience, where the trap is selecting risk assessment instead of impact analysis.

Resilience requirements are established by understanding the consequences of downtime, making Business Impact Analysis (BIA) the primary method. Community consensus confirms that BIA is essential for defining recovery needs.

Selecting Risk Assessment (D) is a common error because while it identifies threats, BIA is required to quantify the specific downtime tolerance needed for resilience.

Community Discussion (3 comments)

koala_lay 👍 1 Selected: C

A business impact analysis (BIA) is the process of identifying and evaluating the potential impacts of a disruption to business operations. The BIA focuses on understanding the critical business functions, the resources required to support those functions, and the consequences of a disruption. This information is then used to determine the appropriate resilience requirements for the application. The other options are not as effective for determining the resilience requirements of an application.

sausageman 👍 2 Selected: C

C - BIA BIA helps understanding the business impact of application downtime or data loss, you can establish the necessary resilience requirements, such as redundancy, failover mechanisms, and disaster recovery plans.

1899f17 👍 1

Should be D

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

A Business Impact Analysis (BIA) is the specific process used to identify critical business functions and quantify the impact of a disruption. By determining the maximum tolerable downtime (MTD) and recovery time objectives (RTO), the BIA directly dictates the necessary resilience levels, such as failover capabilities and data redundancy. As noted in community comments, understanding the impact of data loss or downtime is the prerequisite for establishing these technical requirements.

Why the Other Options Are Wrong

A cost-benefit analysis (A) evaluates financial feasibility but does not determine the business need for resilience. A threat assessment (B) identifies potential adversaries or events but does not measure the operational impact of their success. A risk assessment (D) combines likelihood and impact to prioritize risks, but the specific requirements for resilience are derived from the impact component (BIA), not the overall risk calculation.

Community Comment Notes

The community strongly supports option C, with 100% of votes agreeing that BIA is the correct approach. Comments highlight that BIA focuses on understanding the consequences of disruption, which is the logical basis for defining resilience parameters like redundancy and disaster recovery plans.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final

Exam Strategy

Focus on the 'Business' aspect of Business Impact Analysis; it translates business needs into technical requirements like RTO and RPO.

Related Analysis

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide