I swear, ISACA loves throwing similar scenario vs BIA questions on these exams. Aren't scenario-based assessments useful too? But for direct mapping of cost to risk, I think only a BIA actually gives you the numbers that let you match cost justifications to real business impact. KRIs aren't granular enough here. Anyone see exam reports that say differently?
Q: 3
Which of the following should be the FIRST step in planning an IT governance implementation?
Options
Discussion
C. saw a similar scenario in my last mock. BIA gives the actual numbers you need when comparing site costs to risk. KRIs and scenarios help but don't map dollars as directly. Pretty confident here but open to other takes.
A is wrong, C. KRIs help track risk trends, but BIA actually assigns financial values to downtime so you can align DR site costs with real business impact. Scenario-based is tempting but doesn't directly quantify dollars at risk. Pretty sure it's C unless I'm missing something subtle.
Be respectful. No spam.
Question 3 of 35