Explanation/Reference:
Explanation:
The Contingency Planning Coordinator is not responsible to distribute the contingency plan to all employees.
Incorrect Answers:
A: Once a continuity plan is developed, it actually has to be put into action. The people who are assigned specific tasks need to be taught and informed how to fulfill those tasks, and dry runs must be done to walk people through different situations. The drills should take place at least once a year, and the entire program should be continually updated and improved.
C: Version control is critical. A strict version control of the IT contingency should be kept.
D: There should be two or three copies of these plans. One copy may be at the primary location, but the other copies should be at other locations in case the primary facility is destroyed.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 951

Risk is a function of the likelihood of a given threat-source's exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization. Risk assessment is the first process in the risk management methodology. The risk assessment
process helps organizations identify appropriate controls for reducing
or eliminating risk during the risk mitigation process.
To determine the likelihood of a future adverse event, threats to an
IT system must be analyzed in conjunction with the potential vulnerabilities and the controls in place for the IT system. The likelihood that a potential vulnerability could be exercised by a given threatsource can be described as high, medium, or low. Impact refers to the magnitude of harm that could be caused by a threat's exploitation of a vulnerability. The determination of the level of impact produces a
relative value for the IT assets and resources affected. Source: NIST
Special Publication 800-30, Risk Management Guide for Information Tech- nology Systems.