CHAPTER 3 – ASSESSING RISKS IN THE ENTERPRISE
TRUE/FALSE
1. Risk assessment is the fundamental building block of disaster recovery planning.
2. The inventory sheet should include a three-digit facility number and a building number to identify the
buildings being inventoried.
3. Light equipment includes manufacturing, transportation, and industrial plant equipment.
4. Data for the requirements analysis comes primarily from the exposure inventory sheets for each
facility.
5. The sales inventory sheet details the resources needed to support sales.
6. Data on natural disaster is relatively easy to obtain from historical records.
7. Risk assessment reports should be circulated both inside and outside the organization to update both
employees and investors.
8. The table above is an example of a revenue collection inventory sheet.
9. The table above is an example of a facilities exposure inventory overview sheet.
MODIFIED TRUE/FALSE
1. Gains and potential losses are delicately balanced against each other when determining how to
approach disaster recovery planning. _________________________
2. An exposure inventory should be conducted for each facility that an organization owns or operates.
_________________________
3. The first necessary sheet is the physical facilities exposure inventory sheet.
_________________________
4. The facility number combines the building number with a unique three-digit number.
_________________________
5. The physical facilities exposure inventory sheet shows among other things, the square footage of the
building. _________________________
6. The installed systems exposure inventory sheet lists all large systems, servers, workstations and related
peripherals. _________________________
7. Revenue collection is a goal of a product-focused organization. _________________________
8. The exposure inventory can easily be related to physical facilities and property.
_________________________
9. A business process inventory illustrates the installed systems on which the departments rely.
_________________________
10. The exposure inventory sheets provide a bottom-up data collection process.
_________________________
MULTIPLE CHOICE
1. Which of the following is not part of an exposure inventory list?
a.
Facilities
c.
Baselines
b.
Processes
d.
Systems
2. If an organization has six facilities, how many exposure inventory sheets should they have?
a.
1
c.
6
b.
3
d.
12
3. Which of the following is an example of a numbering scheme for an Information Technology exposure
inventory sheet?
a.
PEIS01
c.
ITEIS01
b.
ITIS01
d.
ITIS01
4. Which of the following is an example of a numbering scheme for an office equipment exposure
inventory sheet?
a.
OEIS01
c.
ITIS01
b.
OEEIS01
d.
PEEIS01
5. Which of the following is an example of a numbering scheme for an installed systems exposure
inventory sheet?
a.
ISEIS01
c.
OSEIS01
b.
ISE01
d.
ISSIS01
6. If a specific exposure inventory sheet is not needed for a facility what should you do?
a.
b.
c.
d.
7. A unique ____-digit number is part of the building number.
a.
two
c.
four
b.
three
d.
five
8. Which of the following is not part of a physical facilities inventory sheet?
a.
b.
c.
d.
9. Which of the following is part of a personnel exposure inventory sheet?
a.
Furniture
c.
Special lighting
b.
Tools
d.
Business processes
10. A heavy equipment exposure inventory sheet should contain ____ equipment.
a.
maintenance
c.
desktop
b.
emergency
d.
transportation
11. A light equipment exposure inventory sheet should contain ____.
a.
lighting equipment
c.
tools
b.
security systems
d.
industrial plant
12. An installed systems exposure inventory list contains ____.
a.
computer networks
d.
both a and b
b.
fire prevention systems
e.
both a and c
c.
large systems
13. An information technology exposure inventory sheet lists ____.
a.
all computer networks
d.
both a and c
b.
copiers
e.
a, b, and c
c.
servers
14. Which of the following is NOT included on an information technology exposure inventory sheet?
a.
Copiers
c.
Desktop computers
b.
PDAs
d.
Workstations
15. Which of the following is included on an office equipment exposure inventory sheet?
a.
Furniture
d.
Both a and b
b.
Cabinetry
e.
a, b, and c
c.
Fax machines
16. A products/parts exposure inventory sheet lists ____.
a.
finished products
d.
both a and b
b.
raw materials
e.
a, b, and c
c.
large systems
17. Which of the following are primary types of organizations?
a.
Manufacturing-focused
d.
Both a and c
b.
Product-focused
e.
Both a and b
c.
Engineering-focused
18. Which of the following goals are common between product- and service-focused organizations?
a.
Revenue collection
c.
Platform
b.
Distribution
d.
Delivery
19. Which of the following requirements can affect the classification of systems?
a.
Competitive
c.
Financial
b.
Contractual
d.
Humanitarian
20. Which of the following pressures can affect the classification of systems?
a.
Legal
c.
Management
b.
Social
d.
Financial
21. Which of the following expectations can affect the classification of systems?
a.
Labor
c.
Social
b.
Management
d.
Contractual
22. A business process inventory illustrates ____ areas.
a.
6
c.
8
b.
7
d.
10
23. The ____ inventory sheet provides detailed information about product sales.
a.
sales
c.
sales requirement
b.
sales support
d.
none of the above
24. The ____ support requirements sheet details the resources needed to support service delivery.
a.
sales
c.
service delivery
b.
service
d.
service inventory
25. The ____ inventory sheet provides detailed information about manufacturing.
a.
product
c.
manufacturing support
b.
product manufacturing
d.
manufacturing requirement
26. The ____ requirements sheet details the resources needed to support procurement.
a.
procurement support
c.
product manufacturing
b.
procurement inventory
d.
product manufacturing support
27. The ____ threat inventory sheet details the threats to an entire facility, as well as threats to heavy
equipment, light equipment, and installed systems.
a.
business process
c.
facility
b.
organization
d.
structural process
28. The ____ threat mitigation sheet details the actions taken or the systems in place to reduce the impact
of threats.
a.
facility
c.
business process
b.
organization
d.
system process
29. Which type of threat can be extremely difficult to quantify?
a.
Natural disasters
d.
Both a and b
b.
Accidents
e.
Both b and c
c.
Disruptive deliberate actions
30. Which type of threat can be quantified by collecting data on frequency, severity, and proximity to
facilities?
a.
Severe weather
c.
Building explosions
b.
Train derailments
d.
Computer hacks
31. Which type of threat can be quantified by collecting data on the political stability of the region where
facilities are located?
a.
Severe weather
c.
Civil unrest
b.
Air pollution caused by accident
d.
Building fire
32. Which inventory sheet is displayed in the table above?
a.
Personnel exposure
c.
Light equipment exposure
b.
Physical facilities exposure
d.
Product/parts exposure
33. Which support requirements sheet is displayed in the table above?
a.
Revenue collection
c.
Product distribution
b.
Sales
d.
Service delivery
YES/NO
1. Do disaster recovery planners also need to look at the process from the top down?
2. The procurement support requirements sheet provides detailed information about procurement.
3. Planners should use a three-pronged approach to determine which threats could adversely affect their
company’s assets and operations.
4. The key to identifying threats is thoroughness.
5. To determine what types of natural disasters may affect operations at a specific facility, the planning
team must assess the areas surrounding a facility and its proximity to public thoroughfares and utility
right-of-ways.
6. The approach to quantifying potential threats depends on the type of threat being analyzed.
7. A risk assessment report ends by detailing to which types of threats an organization is susceptible.
8. The risk assessment reports and the materials used to compile them should be treated as confidential.
9. Should the physical facilities exposure inventory sheet contain information on building renovations?
10. Should the heavy equipment exposure inventory sheet contain information on the system type of the
equipment?
COMPLETION
1. A(n) ____________________-focused organization creates or distributes physical goods.
2. The ____________________ is the facility or equipment necessary to deliver services in a service
focused organization.
3. The ____________________ support requirements sheet details the resources needed to support
manufacturing.
4. ____________________ include train derailments, motor vehicle collisions, construction mishaps,
planes crashes, equipment fires, stored material explosions or fires, building collapses, and bridge
outages.
5. A facility threat ____________________ sheet details the actions taken or the systems in place to
reduce the impact of the threats described in the facility threat inventory sheet.
6. A(n) ____________________ report describes an asset or business process that is exposed to risk, the
risks themselves, and the effectiveness of existing systems designed to mitigate these risks.
7. ____________________ is the process of collecting money from customers.
8. ____________________ is the process of selling services to new and existing customers.
MATCHING
Match the following terms to the appropriate definition.
a.
b.
c.
d.
e.
f.
g.
h.
i.
j.
1. A form that keeps track of detailed business process inventories
2. Includes tools, cleaning & maintenance equipment, and emergency equipment
3. An annotated list of key business processes needed to maintain operations
4. Includes manufacturing, transportation, and industrial plant equipment
5. Includes relevant information about a building within an organization
6. Contains information about resources required to support business processes
7. A form that details assets at the facility
8. Provides detail on facilities, buildings, and departments that support a process
9. Provides information about product distribution for a specific division
10. List of facilities, processes, systems, and resources needed to sustain revenue
SHORT ANSWER
1. List seven areas that should be included in an exposure inventory.
ANS:
2. What should be included in a personnel exposure inventory sheet?
ANS:
3. What are the two primary types of organizations?
ANS:
4. What are the five key goals for a product-focused organization?
ANS:
5. What are the five key goals for a service-focused organization?
ANS:
6. What three things must planners fully understand before they can start classifying the organization’s
systems and functions?
ANS:
7. What eight things does a business process inventory illustrate?
ANS:
8. What two approaches can planners use to determine which threats could adversely affect their
organization’s assets?
ANS:
9. What kind of actions could be included in destructive or deliberate actions against a facility and its
operations?
ANS:
10. What four forms can help disaster recovery planners record the potential threats to their facilities, as
well as details of actions and systems that can mitigate these threats?
ANS: