1. What is the goal and purpose of a business impact analysis (BIA)?2. Why is a business impact analysis (BIA) an important first step in defining a business continuityplan (BCP)?3. What is the definition of recovery time objective (RTO)? Why is this important to define in an ITSecurity Policy Definition as part of the business impact analysis (BIA) or business continuityplan (BCP)?4. How do risk management and risk assessment relate to a business impact analysis (BIA) for an ITinfrastructure?Performing a Business Impact Analysis for a Mock IT Infrastructure5. True or false: If the recovery point objective (RPO) metric does not equal the recovery timeobjective (RTO), you can potentially lose data that might not be backed up. This represents a gapin potential lost or unrecoverable data.6. If you have an RPO of 0 hours, what does that mean?7. What must you explain to executive management when defining RTO and RPO objectives for theBIA?8. What questions do you have for executive management in order to finalize your BIA?9. Why do customer service business functions typically have a short RTO and RPO maximumallowable time objective?10. To write backup and recovery procedures, you need to review the IT systems, hardware, software,and communications infrastructure that supports business operations and functions, and you needto define how to maximize availability. This alignment of IT systems and components must bebased on business operations, functions, and prioritizations. This prioritization is usually theresult of a risk assessment and how those risks, threats, and vulnerabilities impact businessoperations and functions. What is the proper sequence of development and implementation for thefollowing plans?:Business Continuity Plan:Disaster Recovery Plan:Risk Management Plan:Business Impact Analysis:11. How does a BCP help mitigate risk?12. What kind of risk does a BCP help mitigate?13. If you have business liability insurance, asset replacement insurance, and natural disasterinsurance, do you still need a BCP or disaster recovery plan (DRP)? Why or why not?14. From your scenario and BIA from the Performing a Business Impact Analysis for a Mock ITInfrastructure lab in this lab manual, what were the mission-critical business functions andoperations you identified? Are these the focus of your BCP?15. What does a BIA help define for a BCP?16. Who should develop and participate in an organization’s BCP?17. Why do disaster planning and disaster recovery belong in a BCP?18. What is the purpose of having documented IT system, application, and data recovery proceduresand steps?19. Why must you include testing of the plan in your BCP?20. How often should you update your BCP document?21. In your BCP outline, where will you find a list of prioritized business operations, functions, andprocesses?22. In your BCP outline, where will you find detailed backup and system recovery information?23. In your BCP outline, where will you find a policy definition defining how to engage your BCPdue to a major outage or disaster?24. In your BCP outline, where will you find a policy definition defining the resources that areneeded to perform the tasks associated with business continuity or disaster recovery?25. What is the purpose of testing your BCP and DRP procedures, backups, and recovery steps?