712-50 Question 283
Single answerDesign documentation process as part of the continuity of operations programA newly appointed CISO is formalizing the design documentation process for the organization’s continuity of operations program (COOP). During a recent regional outage, recovery teams used different versions of recovery procedures, vendor contacts were outdated, and several system dependencies were undocumented, causing restoration delays. The CISO wants a documentation approach that will improve recovery execution while satisfying governance expectations. Which action should the CISO prioritize FIRST when designing the documentation process?
- A
Establish a controlled documentation framework that assigns ownership, version control, review intervals, and approval requirements for all continuity documents
- B
Require each business unit to maintain its own continuity procedures independently so updates can be made faster without centralized oversight
- C
Focus documentation efforts on the most critical applications only, because documenting supporting dependencies can be deferred until after the next exercise
- D
Store final continuity plans in an offline archive managed by records management, and limit edits to annual policy review cycles
Show answer and explanation
Correct answer: A
Explanation
In a continuity of operations program, the documentation process must ensure that plans are accurate, controlled, available, and maintainable. The scenario highlights common failures: conflicting plan versions, stale contact information, and undocumented dependencies. These are indicators of weak document governance rather than merely incomplete plan content. The best first step is to establish a formal documentation framework that defines ownership, versioning, review frequency, approval authority, distribution, and change management.
Best practices in business continuity and disaster recovery documentation generally include: assigning accountable document owners; maintaining document version history; linking updates to business, technology, and organizational changes; reviewing documents on a defined schedule and after exercises or incidents; and ensuring both accessibility during crises and protection against unauthorized modification. Standards and guidance such as ISO 22301 emphasize documented information control, maintenance, and continual improvement. A mature COOP documentation process also includes dependency mapping, escalation paths, communication procedures, recovery priorities, and validated contact information. Without governance over documentation, even well-written plans quickly become unreliable during an actual disruption.
- A. Correct.
Correct. The immediate problem is not just missing content, but the lack of a formal documentation process. A controlled framework with defined document owners, version control, review schedules, and approval workflows is the foundational step that ensures continuity plans, contact lists, recovery procedures, and dependency maps remain current, authoritative, and usable during an event. In COOP and broader business continuity/disaster recovery practice, document governance is essential before an organization can reliably maintain detailed content.
- B. Incorrect.
Incorrect. Decentralized maintenance without centralized standards often creates exactly the problem described: inconsistent formats, outdated procedures, and conflicting versions. Business units should contribute and own relevant content, but the CISO should still implement enterprise-level governance, standards, and control over continuity documentation.
- C. Incorrect.
Incorrect. Prioritizing critical applications is reasonable for phased implementation, but deferring dependencies is a major continuity design flaw. Recovery failures commonly occur because upstream and downstream dependencies, shared services, infrastructure, third parties, and communication requirements are not documented. This option addresses scope, but not the root governance weakness in the documentation process.
- D. Incorrect.
Incorrect. Offline copies can be valuable for resilience, especially if primary systems are unavailable, but limiting updates to annual cycles is too infrequent for continuity documentation that includes rapidly changing contacts, systems, vendors, and recovery steps. Archival storage does not solve the need for active document control and regular review.