Business Continuity Requirements, Personnel Security, and Risk Management

Introduction

This lesson completes the core of Domain 1, Security and Risk Management (16% of the exam, ISC2 exam outline effective 15 April 2024). It covers three connected themes: how an organization identifies what it must keep running (business continuity requirements and the business impact analysis), how it manages the people who hold access (personnel security), and how it identifies, measures, and treats risk. Risk management is the engine of the whole CISSP: nearly every question in the other seven domains can be answered by asking "what does the risk-based, business-aligned answer look like?"