Security and Risk Management · Topic 5 of 7
Business Continuity Requirements
Business continuity requirements for CISSP: scope, the business impact analysis, critical functions, MTD, RTO, RPO and WRT, and how they drive recovery strategy.
- 3 min
- Includes a diagram
- BC needs senior management sponsorship and a defined scope.
- The BIA identifies critical functions, impacts over time, recovery requirements and dependencies.
- MTD is survival time; RTO restore time; RPO data loss; WRT catch-up time.
What it is
Business continuity (BC) keeps critical business functions running during and after a disruption. Before any recovery strategy is chosen, the organization must know which functions matter, how long it can survive without them and how much data it can lose. That is the job of the business impact analysis (BIA).
How it works
Starting the BC effort
- Senior management sponsorship: BC needs authority and budget.
- Scope: which sites, functions and scenarios are included.
- Team: business units, IT, security, facilities, legal, HR and communications.
- Resources and requirements: legal, regulatory and contractual continuity obligations.
The business impact analysis
The BIA identifies critical business functions and the impact of losing them over time. It is business-driven: interview process owners, not only IT.
| BIA step | Output |
|---|---|
| Identify business functions and processes | List of functions with owners |
| Assess impact of disruption over time | Financial, legal, regulatory, reputational and safety impacts |
| Determine recovery requirements | MTD, RTO, RPO per function |
| Identify dependencies | Systems, people, suppliers, facilities each function needs |
| Prioritize | Ranked list of critical functions |
The BIA comes before recovery strategies. A question asking what must be done before choosing strategies points to the BIA.
Key recovery metrics
| Metric | Meaning |
|---|---|
| MTD (maximum tolerable downtime), also MAD or MTPD | Longest the business can survive without the function |
| RTO (recovery time objective) | Target time to restore the system or function |
| RPO (recovery point objective) | Maximum acceptable data loss, measured in time |
| WRT (work recovery time) | Time after systems return to verify data and catch up on work |
The relationship is RTO + WRT must not exceed MTD. Example: MTD 10 hours and RTO 6 hours leave 4 hours of work recovery time.
Prioritizing defensibly
When every department rates itself critical, use common criteria approved by executives: financial loss, legal and regulatory exposure, safety, reputation and customer impact. Executives, not individual departments, settle disputes about priority.
From requirements to implementation
The BIA feeds:
- Recovery strategies (domain 7): alternate sites, backups, redundancy.
- The business continuity plan: roles, procedures, communication.
- Testing and maintenance: exercises and updates after significant changes such as acquisitions.
Dependencies people forget
Suppliers, single key staff, shared utilities, and third-party services. A critical function that depends on a single supplier in the same flood zone needs an alternate supplier or buffer stock, not just a note in the plan.
How the exam asks about this
- "Which deliverable is needed to choose recovery strategies?" The BIA's ranked critical functions with recovery times and dependencies.
- "MTD 10 hours, RTO 6 hours; how long can staff spend re-entering data?" 4 hours.
- "Executives decline to fund BC." Present BIA impact by outage duration in business terms.
What to remember for the exam
- BC needs senior management sponsorship and a defined scope.
- The BIA identifies critical functions, impacts over time, recovery requirements and dependencies.
- MTD is survival time; RTO restore time; RPO data loss; WRT catch-up time.
- RTO plus WRT must fit within MTD.
- Strategies and plans follow the BIA, never the other way round.
The BIA measures business impact. A list of IT systems ranked by IT staff is not a BIA.
Common mistakes
Choosing a recovery site before the BIA. Requirements come first.
Confusing RTO with RPO. One is time to restore; the other is data loss.
Letting each department rate itself. Priorities need common criteria.
Check yourself
What must be completed before recovery strategies are selected?
The business impact analysis.
What does RPO measure?
The maximum acceptable amount of data loss, expressed as time.
MTD is 10 hours and RTO is 6 hours. What is the most time available for work recovery?
4 hours.
Topic 5 of 7 in Security and Risk Management
Test yourself on Security and Risk Management
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.