The correct answer isBbecause a change in business strategy that affects an application’srecovery point objective (RPO)means the organization’s assessment of business criticality, recovery requirements, and time-sensitive dependencies has changed. These are determined through thebusiness impact analysis (BIA). The BIA is the key document and process used to identify critical business functions, dependencies, and recovery requirements such as recovery objectives.
The other options are less appropriate:
A. IT inventorylists assets, but it does not determine business recovery requirements.
C. Risk registermay eventually reflect related risk changes, but the primary source that drives recovery objective updates is the BIA.
D. CMDBrecords configuration items and relationships, but not business-driven recovery requirements at the same level as a BIA.
Exact Extracts supporting the answer:
“The main outcome of a business impact analysis (BIA) is the criticality of business processes.”
“The most useful process in developing a series of recovery time objectives is business impact analysis.”
“A business impact analysis is primarily used to evaluate the impact of disruption on an enterprise’s ability to operate over time.”
“The objective of a business impact analysis is best described as the identification of time-sensitive critical business functions and interdependencies.”
“To best help an enterprise analyze risk incidents and related interdependencies to determine the impact on enterprise goals is a business impact analysis.”
These extracts show that recovery requirements are business-driven and are established through the BIA. Therefore, if business strategy changes and RPO must be increased, thebusiness impact analysismust be updated.
===========
