Exam CISSP topic 1 question 378 discussion

I think with the involvement of key stakeholders you can develop a clear evaluation criteria based on those stakeholders' inputs. If you develop an evaluation criteria without th ekey stakeholders you may end up with an inconclusive criteria. Just my opinion.

A is Correct CISSP Domain 7 (Security Operations): Testing a DR/BCP requires structured preparation. Evaluation criteria define how success is measured (e.g., meeting RTO/RPO, restoring critical systems). Without these criteria, the test lacks purpose and measurable outcomes. NIST SP 800-34 (Contingency Planning Guide): Explicitly states that defining test objectives and evaluation criteria is the first step in test preparation (Section 3.4.1). This ensures alignment with business priorities and compliance requirements. BCP/DRP Lifecycle: Stakeholders (B) and failure points (D) are identified during the planning phase (e.g., Business Impact Analysis).

he first step prior to executing a test of an organization's disaster recovery (DR) or business continuity plan (BCP) is to develop clear evaluation criteria.

Prior to a test? .. NOW you want to identify stakeholders? shouldnt that have been done at an earlier point. B is more in line with this specific scenario the question is asking about.

Stakeholders first

The stakeholders should've been defined when drafting the BCP. The first thing to do before execution of a test is to define the evaluation criteria.

Answer A) To derive the most value from the test, the Contingency Planning Coordinator should develop a test plan designed to test the selected element(s) against explicit test objectives and success criteria. Page 27 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34.pdf

B. Identify key stakeholders. Identifying key stakeholders is essential because they are the individuals or groups who have a vested interest in the success of the DR or BCP test. Involving key stakeholders from the beginning ensures that their requirements, concerns, and expectations are taken into account during the planning and execution of the test. This helps to align the test with the organization's goals and ensures that the right people are involved in the process. Once key stakeholders are identified, other steps such as developing evaluation criteria can follow.

To derive the most value from the test, the ISCP Coordinator should develop a test plan designed to examine the selected element(s) against explicit test objectives and success criteria. The use of test objectives and success criteria enable the effectiveness of each system element and the overall plan to be assessed. - NIST 800

typo - successful or not is to be determined....

B. successful not are to be determined by evaluation criteria which were developed and/or agreed by the key stakeholders (judges) who may or may not involved in the DR/BCP planning.

The FIRST step prior to executing a test of an organization's disaster recovery (DR) or business continuity plan (BCP) is to define the objectives and scope of the test. This includes identifying the critical systems, applications, and data that need to be tested, as well as the specific scenarios or events that the test will simulate. Additionally, it is important to define the success criteria for the test, such as recovery time objectives (RTOs) and recovery point objectives (RPOs), to ensure that the plan meets the organization's business requirements. This pre-test planning and scoping will help to ensure that the test is focused, efficient, and effective in validating the organization's DR/BCP readiness and identifying any gaps or areas for improvement.

Identifying key stakeholders is important because they are the individuals or groups who have a vested interest in the success of the disaster recovery or business continuity plan. These stakeholders can include senior management, IT personnel, end-users, external customers, and regulatory bodies. The involvement of these stakeholders is critical in the testing phase of the plan, as they can provide valuable input on the effectiveness of the plan, as well as help to identify any potential gaps or weaknesses in the plan. In other words stakeholders provide input and feedback on the evaluation criteria, which may result in changes to the criteria. It's important to involve stakeholders in the planning and testing of disaster recovery and business continuity plans to ensure that their needs and concerns are addressed. This can help to ensure that the testing process is effective and that the resulting plans are well-designed and well-received.

A. Develop clear evaluation criteria.

Aren't the key stakeholders identified in the DR/BC plans. This question is about testing.

B. Identify key stakeholders. C. Develop recommendations for disaster scenarios. D. Identify potential failure points. - are all parts of creating the DR/BC plans. How measuring how they work is evaluation criteria.

I think that if you are about to test a BCP you should already be aware of who the stakeholders are, so my bet is on A. Lets have a discussion.