PECB ISO-22301-Lead-Implementer : ISO 22301 Lead Implementer Certification Exam

Which of the following is NOT a necessary component of a nonconformity report?

• A. The date and time of the nonconformity occurrence.
• B. A description of the requirements for which the nonconformity was detected.
• C. A description of the observed nonconformity.

Which of the following can be used as a performance indicator to evaluate the performance of the BCMS?

• A. The average cost of a disruption.
• B. The number of employees in the organization.
• C. The percentage of the assets damaged within a timeframe.

An organization has implemented controls to prevent the unauthorized disclosure of documented information required by the BCMS. Is this in compliance with ISO 22301?

• A. No, the protection of documented information against unauthorized disclosure is not required but it is a good practice to follow.
• B. Yes, only if the documented information required by the BCMS is stored electronically.
• C. Yes, documented information should be protected from loss of confidentiality.

Scenario:
Marketiser, a marketing company in Florida specializing in branding, advertising, market research, and design services, primarily serves small and medium-sized enterprises. After a devastating hurricane caused severe flooding and rendered its office unusable, Marketiser decided to implement a BCMS based on ISO 22301 to handle such disruptions.
The company formed a project team of four members from various departments and appointed Danielle as the project manager. Danielle conducted a comprehensive business impact analysis (BIA) focusing on activities related to data loss and backup recovery, recognizing the critical importance of safeguarding digital assets.
She set specific recovery objectives, including a one-day recovery point objective (RPO) and a two-day recovery time objective (RTO).
Based on the BIA outcomes, the team chose a business continuity strategy that involved relocating preconfigured trailers with essential hardware and connectivity to an alternate site. Considering Marketiser's vulnerability to hurricanes, the strategy allowed swift activation and relocation with minimal lead time. To validate their strategy, Danielle and the team conducted real-time recovery exercises, testing their ability to restore data and resume critical operations within the defined RTO.
Danielle and the implementation team conducted a business impact analysis (BIA) for all activities related to data loss and backup recovery. Is this acceptable?

• A. Yes, a BIA covering a group of activities is acceptable to be performed.
• B. Yes, it allows better identification of the business continuity objectives such as RTO and RPO.
• C. No, the impact criticality cannot be evaluated if a BIA comprises several activities.

Scenario:
Belle, a food and beverage processing company, is dedicated to crafting products that meet customers' needs while promoting healthier lifestyles. Central to its mission is a commitment to upholding the highest food safety standards and ensuring the consistent quality of their offerings. From the initial stages of preparation through processing, packaging, and transportation, Belle maintains rigorous control over every aspect of food production.
Recognizing the importance of resilience in potential disruptions, Belle adopted a business continuity management system (BCMS) based on ISO 22301. By implementing this system, Belle aimed not only to ensure uninterrupted product delivery but also to enhance its reputation, foster customer confidence, and gain a competitive edge. To oversee the BCMS implementation, Belle appointed a dedicated business continuity project team responsible for leading the BCMS implementation project. It also assigned a business continuity manager responsible and accountable for the BCMS overall.
Before initiating the BCMS implementation, the BCM team conducted a thorough analysis of the stakeholders involved. Using specialized tools, they categorized stakeholders according to their influence, expected level of involvement, and anticipated contribution throughout the implementation of the BCMS and related activities.
Throughout the BCMS implementation process, Belle's top management emphasized the integration of business continuity principles into existing processes, aligning them with the organization's strategic objectives. They developed the business continuity objectives and the BCMS scope. To ensure widespread understanding and adoption of the BCMS among employees,the BCM team developed an instructional video explaining the business continuity policy. Recognizing the unfamiliarity of employees with business continuity terminology, the team subsequently devised a comprehensive training program aimed at enhancing staff competence in BCMS matters. This initiative not only educated employees about the policy but also underscored the benefits of improved business continuity performance.
The organization also established evaluation methods to assess the impact of competence trainings. It measured the staff engagement and retention levels, as well as performance against training objectives.
As Belle continued to innovate and expand its product and service offerings, the organization revisited its BCMS scope to remain aligned with evolving priorities. Recent additions to the scope included a new department and two new products aligning with its updated business continuity objectives to enhance the safety of raw materials and key ingredients.
In response to potential disruptive risks, Belle established clear protocols outlining specific actions to be taken, assigning responsibilities, and defining criteria for evaluating the effectiveness of these measures. By proactively addressing risks and fortifying its resilience, Belle aimed to uphold its dedication to delivering safe, top-quality products while also safeguarding the interests of its stakeholders.
Belle decided to modify its BCMS scope, which was established at the beginning of the BCMS implementation process. Is this acceptable?

• A. Yes, the scope may evolve, ensuring that the BCMS continually supports the organization's continuity goals.
• B. Yes, BCMS scope must be updated every three months in order to fit the requirements of the relevant standards.
• C. No, BCMS scope is developed as part of the initial implementation project and as such it should not be modified.