Exam CISM topic 1 question 580 discussion

I think the question is intentionally tricky here. There is no question that BIA is big part of the DR/BCP plan. But it's used to identify Criticality of systems and RTOs based on that. The question is particular is asking what will help to decide the "response". To know how to act you need to know what the threat is or what the risk is. So for me it's Risk assessment.

C for me

Key word is " response" .

Which of the following would BEST provide stakeholders with information to determine the appropriate RESPONSE to a disaster? 1. Vulnerability or threat by themselves cannot provide the complete picture of the risk (rules out A) 2. Impact or likelihood by themselves cannot provide the complete picture of the risk (rules out C) 3. B has no place in this discussion Risk management output is "cost-effective response to risk such that residual risk is within acceptable limits". This cannot be done without the complete picture of the risk profile, only possible through risk assessment.

C. Business impact analysis (BIA)

In summary, while both the BIA and risk assessment have their significance in disaster preparedness and response, the BIA is particularly useful for determining the appropriate response to a disaster by providing stakeholders with essential information about critical processes, recovery priorities, and resource allocation.

Agree that this should be C. See Carl's comments below.

A business impact analysis (BIA) is used to identify an organization’s business processes, the interdependencies between processes, the resources required for process operation, and the impact on the organization if any business process is incapacitated for a time. A BIA is a cornerstone of a business continuity and disaster recovery Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (p. 124). McGraw Hill LLC. Kindle Edition.

BIA is used for BCP.