Exam CISM topic 1 question 856 discussion

My answer is A. The BCP addresses overall business operations and continuity, not just the immediate response to security incidents. manual business operation process can be kicked off while waiting for the system up and running. The IRP, on the other hand, is tailored to handle security events specifically, making it the most effective in reducing their potential impact.

Maybe the word is PRIMARILY. The Incident response plan has other goals containment... erradication... etc. the primarily goal of a BCP is that

Well, if the objective of containment is to reduce the impact of the incident, and we know that "containment" is one of the steps of incident response, then I'd say the correct answer here is A.

A- As per previous questions that cover the fact that incident response teams (and so incidents themselves) are there to mitigate impact

A. Potential impact reduction

The correct answer is B. Business continuity plan (BCP). A BCP is designed to help minimize the impact of a security event, such as a natural disaster, cyber attack, or other unforeseen event, and ensure the continuity of your business operations.

A. Potential impact reduction

Security awareness is most relevant to reducing the likelihood of an incident, especially those related to social engineering and policy non-compliance. IRP's main focus is to reduce the impact/damage of the incident through containment. When the incident reaches a pre-defined threshold (RTO, RPO, SDO...), it is escalated to BCP which then focusses on the continuity of operations at acceptable level using minimum resources. It is an ongoing activity, or as mentioned in ISACA REVIEW MANUAL, ' a continuous process. DRP primarily focusses on recovering operations rather than reducing impacts.

C. Security awareness plan