Business Continuity, Personnel, Supply Chain and Awareness
This topic covers business impact analysis, continuity requirements, personnel security, vendor and supplier risk, security education, training, and awareness.
How to study for CISSP
Treat each CISSP question as a risk decision: identify the owner, objective, control type, lifecycle phase, and business consequence before choosing.
Core concepts
Concept 1
Business Continuity, Personnel, Supply Chain and Awareness questions test whether a security leader can choose a defensible control, process, or governance response for a business risk.
Exam cue: Identify the domain objective: govern risk, protect assets, engineer securely, secure networks, control identity, test, operate, or secure software.
Concept 2
The best CISSP answer usually protects people, policy, data, and mission before jumping to a narrow technical fix.
Exam cue: Match the response to the risk owner, data owner, control objective, lifecycle phase, and assurance evidence in the scenario.
Concept 3
Eliminate answers that skip authorization, ignore legal or contractual duties, weaken least privilege, or confuse preventive, detective, and corrective controls.
Exam cue: Prefer documented policy, due care, defense in depth, least privilege, validated recovery, and continuous improvement.
Risk pitfalls and guardrails
Choosing a tool before confirming business requirements, ownership, and risk treatment.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Treating confidentiality as the only goal when integrity, availability, authenticity, accountability, and safety also matter.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Ignoring legal, regulatory, contractual, audit, and evidence-handling obligations.
Guardrail: Avoid answers that jump to a tool, ignore the risk owner, weaken least privilege, skip evidence, or treat one security objective as the only concern.
Memory anchors
BIA
A business impact analysis identifies critical processes, dependencies, impact, recovery priorities, RTO, and RPO.
RTO
Recovery time objective is the maximum tolerable time to restore a process or service.
RPO
Recovery point objective is the maximum tolerable data loss measured in time.
Personnel Security
Personnel security covers screening, onboarding, transfers, access changes, termination, and role-based training.
Separation of Duties
Separation of duties divides sensitive tasks so one person cannot complete a risky action alone.
Supply Chain Risk
Supply chain risk includes third-party compromise, counterfeit parts, service dependency, and contractual control gaps.
Security Awareness
Awareness changes user behavior by reinforcing policy, reporting, phishing resistance, and safe choices.
Training Effectiveness
Training effectiveness is measured through testing, behavior change, incident trends, and periodic review.
Service Level
A service level defines required performance, availability, support, or security commitments for a provider.
Continuity Exercise
Continuity exercises validate plans, roles, communications, recovery priorities, and lessons learned.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A manufacturer is beginning a business continuity program. What should it do FIRST to ensure later recovery decisions support the enterprise?
A business impact analysis shows that order entry can be unavailable for eight hours, but no more than thirty minutes of orders may be lost. Which pair of requirements is correct?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”