Paul needs to outline different exercise types for the various systems in the
environment. Which of the following does not providing the correct mapping types
that Paul needs to implement?
A.
Low-impact systems, a tabletop exercise
B.
Moderate-impact systems, a functional exercise
C.
High-impact systems, a full-scale functional exercise
D.
Medium-impact, structured walk through
Explanation:
i. For low-impact systems, a tabletop exercise at an
organization-defined frequency is sufficient. The tabletop should simulate a
disruption, include all main ISCP points of contact, and be conducted by the system
owner or responsible authority.
ii. For moderate-impact systems, a functional exercise at an organization-defined
frequency should be conducted. The functional exercise should include all ISCP
points of contact and be facilitated by the system owner or responsible authority.
Exercise procedures should be developed to include an element of system recovery
from backup media.
iii. For high-impact systems, a full-scale functional exercise at an
organization-defined frequency should be conducted. The full-scale functional
exercise should include a system failover to the alternate location. This could
include additional activities such as full notification and response of key
personnel to the recovery location, recovery of a server or database from backup
media or setup, and processing from a server at an alternate location. The test
should also include a full recovery and reconstitution of the information system to
Page 25
Business Continuity Planning – P2.txt
a known state.