The following answers are incorrect:
-
They were not included in any of the Risk Assesment meetings.
-
They were not included in any of the Business Impact Assessment meetings.
-A Business Impact Assessment was not performed.
From the official Guide: "Before the project can even start, it must have total senior management support. Without that support, this project will fail. To convince leadership that the organization needs to build an enterprise-wide BC and DR plan, the planner must sell the importance of the program to the leadership. Senior leadership in any organization has two major goals: grow the business and protect the brand. Business continuity and DR have little to do with growing the business and everything to do with protecting the brand. It is still a hard sell because unless the organization actually has a disaster; the value of the time, money and people resources to build the plan are going to be suspect because it takes away from goal number one, grow the business....
To convince leadership of the need to build a viable DR and BCP, the planner needs to help them understand the risk they are accepting by not having one and the cost to the corporation if a disaster were to occur. The risks to the corporation are found in three areas; financial (how much money the corporation stands to lose), reputational (how badly the corporation will be perceived by its customers and its shareholders), and regulatory (fines or penalties incurred, lawsuits filed against them). There is also the potential that the leaders of the organization could be held personally liable, financially and even criminally, if it is determined that they did not use due care to adequately protect the corporation."
Exam tip: Don't be suprised to see some of these 'soft' questions on the exam. It's important that you take in some of the business side of the chapters than just the technical sides.
Tip from Mike: Way too often, senior management will come down and instruct us that they need a Distaster Recovery plan. Do not make the mistake of assuming that it means you will have their support once the plan is created. While the answer of a BIA was not performed seems right, unless the business case was made sucessfully to the point where you secured their unequivical support (preferrably in writing), your plan will not be accepted the way you would hope.
There is a structure in the way these things need to occur and a big part of it is to secure Senior Managements support. When you are initially tasked, that is the perfect time to sit down with them and ask what their anticipated goals are. It is fine to guide them to the general areas that they should be looking at, but in the end the direction MUST come from them. It is during that time period that you should inform them of the different steps that need to occur; BIA, Risk Assessment (quantitative vs qualititave).
Insist on performing a BIA, even if it is scaled down to meet their goals. If they don't understand why you would do a BIA and assesment, explain to them that you don't want to waste precious resources (time and money) on areas that don't need to protected further. That your goal is the same as theirs, "protecting the brand".
The BIA will force them to look at the potential losses from one of their main tenets "Protect the Brand". Only after they agree to the results of the BIA can you be certain that the business case has been made and you will most likely have their support.
Be prepared to wear your business hat, as you will need to present hard numbers to make your case.
The following reference(s) were/was used to create this question: Tipton, Harold F. (2010-04-20). Official (ISC)2 Guide to the CISSP CBK, Third Edition ((ISC)2 Press), Chapter 8 Business Continuity and Disaster Recovery Planning, Pages 1092-1093

Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the
Ten Domains of Computer Security, 2001, John Wiley & Sons, Pages 16, 32.

The correct answer is "Logical controls". The other answers are different categories of controls where preventive controls attempt to eliminate or reduce vulnerabilities before an attack occurs; detective controls attempt to determine that an attack is taking place or has taken place; and corrective controls involve taking action to restore the system to normal operation after a successful attack.