Skip to content
FR

Business Continuity, Personnel Security and Risk Management

Step 5 of 38

CISSP Business Continuity, Personnel Security and Risk Management

Introduction

CISSP business continuity and risk management connect recovery priorities, people and control investment. This lesson develops objectives 1.7–1.9 in Domain 1, Security and Risk Management (16% of the exam, ISC2 exam outline effective 15 April 2024). It covers three connected themes: how an organization identifies what it must keep running (business continuity requirements and the business impact analysis), how it manages the people who hold access (personnel security), and how it identifies, measures, and treats risk. Risk-based reasoning supports the other domains, but scenario facts, mandatory obligations and the requested action determine the answer.

Practice reasoning about money, uncertainty and business priorities. This lesson follows the outline current on 27 October 2026; ISC2 has announced a new outline effective 15 April 2027.

Learning objectives

After this lesson you can:

  1. Run a business impact analysis (BIA) and derive MTD, RTO, RPO, and recovery priorities, including external dependencies.
  2. Apply personnel security controls across the employment lifecycle: screening, agreements, onboarding, role transfers, and termination.
  3. Govern vendors and contractors through agreements and ongoing oversight.
  4. Perform qualitative and quantitative risk analysis, including SLE, ARO, ALE, and cost-benefit evaluation of controls.
  5. Choose among the four risk responses and explain residual and inherent risk.
  6. Distinguish major risk frameworks (NIST RMF, NIST CSF, ISO/IEC 27005, ISO 31000, FAIR, OCTAVE).
  7. Describe control assessment, continuous monitoring, reporting, and continuous improvement of the risk program.

1. Business continuity requirements

1.1 Where continuity fits

Business continuity (BC) keeps essential business functions operating during and after a disruption. Disaster recovery (DR) restores IT services after an outage and is one component of BC. After governance, scope and planning authority are established, the business impact analysis identifies critical processes and recovery priorities. Security professionals take part because continuity is the availability leg of the CIA triad.

Management support comes first. A project charter signed by senior leaders defines scope, budget, and authority. Without it, departments will not release staff or time for the analysis.

1.2 The business impact analysis

The BIA identifies critical business processes and measures the consequences of losing them over time. Typical steps:

  1. Identify business processes and owners (order entry, payroll, claims adjudication, customer support).
  2. Identify the assets and dependencies each process needs: applications, data, facilities, people, suppliers, utilities, and connectivity.
  3. Estimate impact over time: financial loss, legal and regulatory penalty, reputational harm, safety effects.
  4. Set recovery objectives and priorities based on the impact curve.
  5. Document and present findings to management for approval.

Key metrics:

Metric Meaning Question it answers
MTD / MAO / MTPD Maximum tolerable downtime (also maximum acceptable outage, maximum tolerable period of disruption) How long can the process be disrupted before impacts become unacceptable?
RTO Recovery time objective How quickly must the process or system be restored? Normally shorter than MTD, allowing time for required business work recovery.
WRT Work recovery time Time needed after systems return to verify data and resume normal work.
RPO Recovery point objective How much data loss, measured in time, is acceptable? Drives backup or replication frequency.
MTBF / MTTR Mean time between failures / mean time to repair Reliability and repairability of a component.

When RTO means technical restoration and WRT is the subsequent, non-overlapping business recovery period, budget RTO + WRT ≤ MTD, with a practical contingency margin. Definitions differ across plans, so do not add periods twice if business recovery is already included in the RTO. If a process has an MTD of 24 hours and verification takes 6 hours, the RTO must be 18 hours or less.

1.3 Quantifying continuity requirements: a worked example

Scenario. An online retailer earns about $3.6 million per day, evenly spread over 24 hours, from its order platform. A one-week outage would also trigger contractual penalties from marketplace partners of $400,000. Management says the company cannot survive more than 72 hours without orders. The last full database backup is nightly, and transaction logs ship every 15 minutes. After a restore, the finance team needs 4 hours to reconcile orders.

Step 1: Identify MTD. Management states 72 hours.

Step 2: Derive RTO. With a 4-hour work recovery time, RTO ≤ 72 − 4 = 68 hours. The retailer sets a much tighter 8-hour target because revenue exposure is $150,000 per hour ($3.6 million ÷ 24). This is not automatically lost profit: evaluate delayed sales, margins, penalties and resilience costs before approving the investment.

Step 3: Derive RPO. The business sets the RPO; a successful, restorable log-shipping chain every 15 minutes may support about 15 minutes of recoverable-data age, subject to lag and failures. If the business says it can lose at most five minutes of orders, the current design does not meet the requirement and must change (for instance, more frequent validated log capture or suitable replication). Replication may copy corruption or deletion, so retain independent recoverable versions and test restores.

Step 4: Prioritize. Orders recover first, then payments reconciliation, then reporting.

Why other choices are weaker. Choosing "nightly backups are enough" ignores RPO. Setting RTO equal to the MTD leaves no room for work recovery and breaks the relationship above. Letting IT alone set the numbers skips business ownership: the BIA requires business owners to approve.

1.4 External dependencies

Continuity depends on parties outside the organization: cloud providers, telecommunications carriers, power utilities, payment processors, logistics firms, and software vendors. The BIA must list them and the plan must address each:

  • Contract service-level agreements (SLAs) with recovery times that match the RTO.
  • Alternate suppliers or multiple carriers (diverse routes into the building).
  • Single points of failure in the supply chain, such as one data center provider or one sole-source component.
  • Right to audit, notification duties, and continuity-plan testing clauses in contracts.
  • Regional risks: a supplier in the same flood zone offers no real diversification.

Exam tip: if a scenario's recovery plan assumes a vendor will respond but the contract promises nothing, the missing control is a contractual SLA and a tested alternative.

2. Personnel security

People are both the largest source of risk and the best control. Personnel security applies controls across the employment lifecycle.

2.1 Candidate screening and hiring

  • Background checks (identity, employment history, education, criminal record, credit for financial roles, references) proportional to the sensitivity of the position and consistent with local law.
  • Consent and fairness: checks must follow privacy and employment law. Different countries limit what you may check.
  • Higher scrutiny for privileged roles (administrators, finance, executives) and clearance-based roles.
  • Verification of claims: a fabricated degree is a trust issue regardless of technical skill.
  • Same standards for contractors and temporary workers, who often have equal access.

2.2 Employment agreements and policies

  • Employment agreements state duties and acceptable use.
  • Non-disclosure agreements (NDAs) protect confidential information and trade secrets.
  • Non-compete and non-solicitation clauses are limited by local law.
  • Acceptable use policy (AUP) acknowledgments and code of conduct signatures create enforceable expectations.
  • Separation of duties, least privilege, and risk-appropriate vacation or job rotation can reduce fraud opportunities. Collusion can bypass separation of duties; combine it with independent review and monitoring.

2.3 Onboarding and role transfers

Provisioning follows the joiner-mover-leaver lifecycle:

  • Joiner: grant access based on documented role, with manager approval. Provide security awareness training before access is activated or immediately after.
  • Mover (transfer or promotion): remove prior access and grant the new role's access. Skipping the removal causes privilege creep (accumulated permissions that violate least privilege and may break separation of duties).
  • Leaver: see below.

2.4 Termination

Termination procedures protect the organization from both hostile and ordinary departures:

  1. Coordinate HR, management, and security before the notification when the exit is involuntary.
  2. Disable accounts and revoke credentials at the moment of notification (or earlier for high-risk cases), including remote access, tokens, VPN, cloud console, and badges.
  3. Escort the employee, retrieve equipment, media, and keys.
  4. Perform an exit interview reminding the person of ongoing NDA obligations.
  5. Review recent activity logs for data exfiltration.
  6. Reassign mailboxes, files, and ownership of service accounts and shared secrets, rotating any shared credentials the person knew.

For a voluntary resignation, review risk immediately and retain only explicitly approved access needed during the notice period; revoke access when duties cease or earlier if risk warrants it. Coordinate timing with HR and local law rather than treating every resignation as an immediate involuntary dismissal. Preserve required records instead of deleting accounts or mailboxes indiscriminately.

2.5 Vendor, consultant, and contractor controls

Third-party staff are personnel in practice. Required controls include:

  • Contracts and statements of work that specify security obligations, data handling, background check standards, breach notification times, and the right to audit.
  • Confidentiality agreements and acceptable use acknowledgments.
  • Least-privilege, time-limited accounts tied to a sponsor who is accountable for the contractor.
  • Monitoring of activity and automatic expiry at contract end.
  • Offboarding as rigorous as for employees.
  • Service-level agreements (performance), operational-level agreements (internal teams), and underpinning contracts (supplier support) that tie the arrangement together.

Review the legal obligations and security policy hierarchy when defining screening, monitoring and contractor terms. Remember that you can outsource a task, but not accountability. The organization remains responsible for its data.

3. Risk management

3.1 Vocabulary

Term Meaning
Asset Anything of value: data, systems, people, reputation.
Threat A potential cause of an unwanted event (attacker, flood, malware, error).
Vulnerability A weakness that a threat can exploit.
Risk Potential adverse impact considered together with likelihood and uncertainty; simple numeric models may combine likelihood and impact.
Exposure Susceptibility to loss from a threat.
Control (safeguard/countermeasure) A measure that reduces risk.
Inherent risk Risk before controls.
Residual risk Risk remaining after controls.
Risk appetite Broad amount and types of risk the organization is willing to pursue or retain.
Risk tolerance Specific acceptable limits or variation for an objective or activity.
Risk model An explicit set of assumptions linking events, likelihood, impact and control effects; control counts cannot simply be subtracted from monetary risk.

An organization cannot eliminate all risk. A specific exposure may be avoided by ending an activity, but other risks remain. The authorized risk owner approves treatment and residual risk within delegated limits; escalate decisions beyond tolerance. Security staff advise and may own particular risks when formally assigned.

3.2 Risk assessment steps

  1. Define scope and context and identify assets with their values.
  2. Identify threats and vulnerabilities (threat intelligence, scans, interviews, past incidents).
  3. Analyze likelihood and impact (qualitatively or quantitatively).
  4. Evaluate results against risk appetite and rank them.
  5. Treat each risk and document decisions in a risk register.
  6. Monitor and review continuously.

3.3 Qualitative analysis

Qualitative methods rate likelihood and impact using scales (low/medium/high, or 1–5) and a risk matrix. Ordinal scores prioritize discussion; multiplying a 1–5 score does not turn it into a probability or monetary loss estimate. Techniques include workshops, interviews, surveys, and the Delphi technique (anonymous rounds of expert opinion to avoid bias and groupthink). Qualitative analysis is fast and understandable, but subjective and hard to use for cost-benefit decisions.

3.4 Quantitative analysis

Quantitative methods use money and probabilities.

  • Asset value (AV): value of the asset (replacement cost, lost revenue, regulatory exposure).
  • Exposure factor (EF): percentage of the asset lost in one incident.
  • Single loss expectancy (SLE) = AV × EF.
  • Annualized rate of occurrence (ARO): how many times per year the event is expected (0.1 means once every ten years).
  • Annualized loss expectancy (ALE) = SLE × ARO.
  • Control value = ALE before control − ALE after control − annual cost of control.

A positive ALE-based net benefit supports investment under the stated assumptions. Legal duties, safety, catastrophic tail losses, control dependencies and the full lifecycle cost can justify a control even when this simplified financial estimate is negative. Quantitative analysis is only as good as its inputs, which are estimates, so treat results as informed ranges.

3.5 Worked example: is the control worth buying?

Scenario. A clinic's patient scheduling server is valued at $800,000 (replacement plus loss of business during recovery). A ransomware event would affect 40% of that value. Historical data and industry reports suggest such an event could occur once every four years. A proposed immutable-backup and EDR package costs $45,000 per year and is expected to cut the exposure factor to 10% and the frequency to once every ten years.

Step 1: Before the control. SLE = $800,000 × 0.40 = $320,000. ARO = 1/4 = 0.25. ALE = $320,000 × 0.25 = $80,000.

Step 2: After the control. SLE = $800,000 × 0.10 = $80,000. ARO = 0.1. ALE = $80,000 × 0.1 = $8,000.

Step 3: Value. Reduction = $80,000 − $8,000 = $72,000. Subtract the cost: $72,000 − $45,000 = $27,000 positive value per year. Under the scenario estimates, the control has positive annual net value; test the assumed effectiveness and obtain the owner’s approval.

Why alternatives are weaker. Accepting the risk retains an estimated $80,000 annual expected loss, not a guaranteed annual bill. Transferring through insurance may cover some loss but not reputational or patient-safety harm and does not reduce the likelihood. Avoiding the risk means discontinuing digital scheduling, which harms the mission.

3.6 Risk responses

Response Description Example
Mitigate (reduce) Apply controls to reduce likelihood or impact Patching, segmentation, backups
Transfer (share) Shift financial impact to another party Cyber insurance, outsourcing with contractual liability
Avoid Stop the risky activity Retire an unsupported application
Accept Knowingly take the risk, with documented approval Low-value risk where the control would cost more
Reject / ignore Pretending the risk does not exist Never acceptable

Residual risk must be accepted by the risk owner. Insurance does not remove the duty of due care, and transfer leaves some risk (reputation, legal duty) with the organization.

3.7 Control selection and types

Controls are classified by function (preventive, detective, corrective, deterrent, recovery, compensating, directive) and by implementation (administrative, technical/logical, physical). A compensating control must meet the relevant control objective and acceptance requirements; a cheaper weaker measure is not automatically equivalent. Select controls by considering effectiveness, cost, impact on operations, legal requirements, and the risk appetite. Perform cost-benefit analysis and test the control before relying on it.

3.8 Risk frameworks

Framework Focus
NIST SP 800-37 Risk Management Framework (RMF) Steps: prepare, categorize, select, implement, assess, authorize, monitor. Used heavily in US government systems.
NIST SP 800-30 Guide for conducting risk assessments.
NIST Cybersecurity Framework (CSF) 2.0 Outcome-based functions: Govern, Identify, Protect, Detect, Respond, Recover.
ISO/IEC 27005:2022 Information security risk management within the ISO 27001 management system.
ISO 31000:2018 General enterprise risk management principles.
FAIR Quantitative model that expresses risk in financial terms.
OCTAVE Self-directed, asset-driven risk evaluation led by the organization.
COSO ERM / COBIT Enterprise risk and IT governance.

Frameworks provide a structure; the exam rewards recognizing which framework fits (for example, NIST RMF for authorizing federal systems, ISO 27005 for an ISO 27001 program).

Threat and supplier inputs are developed further in threat modeling and supply chain risk management.

4. Assess, monitor, report, and improve

Risk management is a cycle, not a project.

  • Control assessments: verify that controls are designed correctly, implemented, and operating effectively. Use audits, testing, and automated checks. Independent assessors increase credibility.
  • Continuous monitoring: automated telemetry, vulnerability scans, configuration drift detection, and metrics feed the risk register in near real time.
  • Metrics: key risk indicators (KRIs) warn of rising exposure (for example, the number of critical vulnerabilities older than 30 days); key performance indicators (KPIs) show whether controls perform.
  • Reporting: tailor reports. Executives need business-impact summaries, risk trends, and decisions required; technical staff need details.
  • Continuous improvement: use incidents, tests, and audit findings in lessons-learned reviews, update the risk register, and adjust controls. Maturity models help show progress.
  • Risk register and ownership: every risk has an owner, a treatment, a target date, and a review cycle.
  • Change triggers: mergers, new regulations, new technologies, and major incidents force a reassessment.

5. Mini case study

Situation. Northwind Freight is a regional logistics company with 600 employees. Its dispatch platform is hosted by a single cloud region. The BIA states an MTD of 12 hours for dispatch. The cloud contract promises "reasonable efforts" for restoration and no specific recovery time. The company just promoted a database administrator, Priya, to security engineer, but her old administrative rights remain. A contractor who maintained the routing algorithm finished her assignment last week, yet her VPN account is still active. The CIO suggests buying cyber insurance and treating the matter as closed.

Questions.

  1. What gaps exist in continuity planning?
  2. What personnel security failures exist?
  3. Is insurance an adequate response?

Commented solution.

  1. The single-region dependency and contract do not demonstrate that a 12-hour MTD can be met. Negotiate measurable recovery commitments and evaluate a tested alternate-region or other recovery strategy against the BIA. An uptime SLA or service credit is not proof of recoverability. Verify the RTO plus work recovery time fits within 12 hours.
  2. Priya's retained rights are privilege creep after a role transfer: remove the old DBA permissions and apply least privilege and separation of duties (production-data privileges need explicit job justification and separation-of-duties review). The contractor's account should have been disabled at contract end through an automated expiry and sponsor-led offboarding.
  3. Insurance is risk transfer, not a substitute for mitigation. It may not cover reputational harm or contractual penalties, insurers often require baseline controls, and the organization retains due-care obligations. Combine evaluated mitigation (recovery design, access cleanup) with a considered transfer decision, and have the risk owner document the residual risk.

Recovery architecture and exercises are covered in disaster recovery and business continuity operations.

6. Common pitfalls and exam tips

  • Exam tip: establish scope, context, decision criteria and ownership before identifying assets and evaluating risks; the first step of continuity planning is management support and scope, then the BIA.
  • Exam tip: the BIA is business-led; IT contributes. When asked who sets MTD, the answer is business owners and senior management.
  • Pitfall: confusing RTO and RPO. RTO is about time to restore; RPO is about data loss.
  • Pitfall: treating "accept" as laziness. Acceptance is valid when documented and approved by the risk owner.
  • Pitfall: approving or rejecting controls solely on ALE. Compare full costs and uncertain loss reduction, then include mandatory duties, safety and tail risk.
  • Pitfall: confusing elimination of one activity’s exposure with elimination of all organizational risk.
  • Exam tip: access for a leaver is removed at or before notification for involuntary terminations.
  • Exam tip: background checks depend on the position's sensitivity and on local law.
  • Pitfall: assuming outsourcing transfers accountability. It transfers tasks and some financial impact, not responsibility for data.
  • When a scenario asks for the "best" action, prefer the one that aligns with business objectives, is documented, and is approved by the right owner.

Key terms

  • BIA: analysis of the impact of disruption on critical processes.
  • MTD / RTO / RPO / WRT: maximum downtime, recovery time target, acceptable data loss, work recovery time.
  • Privilege creep: accumulation of access rights after role changes.
  • SLE, ARO, ALE: single loss expectancy, annual rate of occurrence, annualized loss expectancy.
  • Inherent / residual risk: risk before / after controls.
  • Risk appetite: the level of risk the organization is willing to pursue.
  • Compensating control: an alternate control that provides equivalent protection.
  • Risk register: documented list of risks, owners, and treatments.
  • KRI / KPI: key risk indicator / key performance indicator.
  • Delphi technique: anonymous, iterative expert consensus method.

Summary checklist

  • I can explain the BIA steps and the relationships between MTD, RTO, WRT, and RPO.
  • I can calculate SLE, ARO, ALE, and the value of a control.
  • I can name the four risk responses and say who approves residual risk.
  • I can apply screening, agreements, joiner-mover-leaver, and termination controls.
  • I know how to govern vendors and contractors through agreements and oversight.
  • I can match NIST RMF, NIST CSF, ISO 27005, ISO 31000, FAIR, and OCTAVE to their uses.
  • I understand control assessment, continuous monitoring, and reporting to management.

Official sources