Study ISC2 CISSP BIA and Supply Chain Risk: key concepts, common traps, and exam decision cues.
On this page
This side of Domain 1 is about operationalizing governance. The question is usually not whether continuity or personnel controls matter. The question is which one comes first and why.
Continuity-choice map
Requirement
Better first instinct
determine recovery priorities
BIA
choose recovery speed and data-loss targets
RTO and RPO from the BIA
reduce insider and staffing risk
personnel policy and awareness controls
manage external supplier security exposure
supply chain risk management
What the exam is really testing
If the stem says…
Strong reading
“business impact”
the question is about priority and consequence, not technology first
“recovery target”
distinguish restore time from acceptable data loss
“hiring, termination, or contractors”
personnel-security process matters
“supplier or third-party concern”
SCRM controls and monitoring matter
Decision order that usually wins
Identify the business process and consequence of disruption.
Use the BIA to rank priorities before choosing recovery architecture.
Translate business impact into RTO, RPO, staffing, and dependency requirements.
Check whether the scenario is really about people, vendors, or technology.
Choose the continuity or personnel control that addresses the highest-impact weakness first.
On CISSP, the strongest answer is usually the one that starts with business priority rather than the most expensive or most resilient-looking solution.
Scenario triage
Scenario
Better first move
organization cannot decide which systems recover first
perform or update the BIA
executives want a recovery design
derive strategy from RTO and RPO values
insider risk rises during onboarding or exits
tighten personnel security process and access handling
key supplier failure threatens service delivery
assess supply chain dependency and contingency controls
staff ignore continuity responsibilities
improve awareness, training, and role clarity
Common traps
Trap
Better rule
picking a hot site before understanding business priority
BIA should drive strategy
confusing RTO and RPO
one is time to restore, the other is data-loss tolerance
ignoring onboarding or termination controls in insider-risk questions