PECB ISO-22301-Lead-Implementer 問題集

質問 1：
Scenario:
Initar, an IT security service company in New Jersey, provides 24/7 cloud and IT infrastructure support to mid-sized companies. Recognizing the need for a robust business continuity strategy, Initar transitioned from informal business continuity planning to implementing a BCMS based on ISO 22301.
During the BCMS implementation, a major nonconformity was identified: the BIA report lacked a defined Maximum Tolerable Period of Disruption (MTPD), which is required by ISO 22301. The corrective action process began with the IT team conducting a root cause analysis using a cause-and-effect diagram. Based on the analysis, an action plan was drafted to update all BIAs and establish the MTPD. The plan was approved by the head of the IT department, who monitored its implementation, while the internal auditor reviewed the effectiveness of the corrective action.
According to Scenario 7, the internal auditor followed up on the corrective action and reviewed its effectiveness. Is this acceptable?
A. Yes, only if a review of the effectiveness of corrective actions is really necessary.
B. No, based on ISO 22301, it is not the responsibility of the internal auditors to review the effectiveness of corrective actions.
C. Yes, based on ISO 22301, after implementing any actions needed, a review of the effectiveness of corrective actions should happen.
正解：C

質問 2：
Scenario:
Headquartered in Sri Lanka, Operons Inc. is a freight forwarding company that adopted a BCMS aligned with ISO 22301. Prior to the certification audit, Operons Inc. measured gaps between their BCMS and the standard's requirements to ensure compliance. The certification body was contracted to conduct the audit, and a biased auditor from a previous ISO 9001 audit was replaced upon request. During the audit, two minor nonconformities were identified, and the audit team issued a recommendation for certification.
The top management determined the time required to plan and accomplish the audit activities, and they agreed that the audit activities should be completed within two weeks. Is this acceptable?
A. No, the external audit activities for a BCMS must take more than two weeks to be completed.
B. Yes, the top management must determine the audit time, usually no more than two weeks, for the completion of audit activities.
C. No, the certification body determines the time required to plan and accomplish the audit activities.
正解：B

質問 3：
Scenario:
Belle, a food and beverage processing company, is dedicated to crafting products that meet customers' needs while promoting healthier lifestyles. Central to its mission is a commitment to upholding the highest food safety standards and ensuring the consistent quality of their offerings. From the initial stages of preparation through processing, packaging, and transportation, Belle maintains rigorous control over every aspect of food production.
Recognizing the importance of resilience in potential disruptions, Belle adopted a business continuity management system (BCMS) based on ISO 22301. By implementing this system, Belle aimed not only to ensure uninterrupted product delivery but also to enhance its reputation, foster customer confidence, and gain a competitive edge. To oversee the BCMS implementation, Belle appointed a dedicated business continuity project team responsible for leading the BCMS implementation project. It also assigned a business continuity manager responsible and accountable for the BCMS overall.
Before initiating the BCMS implementation, the BCM team conducted a thorough analysis of the stakeholders involved. Using specialized tools, they categorized stakeholders according to their influence, expected level of involvement, and anticipated contribution throughout the implementation of the BCMS and related activities.
Throughout the BCMS implementation process, Belle's top management emphasized the integration of business continuity principles into existing processes, aligning them with the organization's strategic objectives. They developed the business continuity objectives and the BCMS scope. To ensure widespread understanding and adoption of the BCMS among employees, the BCM team developed an instructional video explaining the business continuity policy. Recognizing the unfamiliarity of employees with business continuity terminology, the team subsequently devised a comprehensive training program aimed at enhancing staff competence in BCMS matters. This initiative not only educated employees about the policy but also underscored the benefits of improved business continuity performance.
The organization also established evaluation methods to assess the impact of competence trainings. It measured the staff engagement and retention levels, as well as performance against training objectives.
As Belle continued to innovate and expand its product and service offerings, the organization revisited its BCMS scope to remain aligned with evolving priorities. Recent additions to the scope included a new department and two new products aligning with its updated business continuity objectives to enhance the safety of raw materials and key ingredients.
In response to potential disruptive risks, Belle established clear protocols outlining specific actions to be taken, assigning responsibilities, and defining criteria for evaluating the effectiveness of these measures. By proactively addressing risks and fortifying its resilience, Belle aimed to uphold its dedication to delivering safe, top-quality products while also safeguarding the interests of its stakeholders.
Belle decided to modify its BCMS scope, which was established at the beginning of the BCMS implementation process. Is this acceptable?
A. No, BCMS scope is developed as part of the initial implementation project and as such it should not be modified.
B. Yes, BCMS scope must be updated every three months in order to fit the requirements of the relevant standards.
C. Yes, the scope may evolve, ensuring that the BCMS continually supports the organization's continuity goals.
正解：C

質問 4：
Scenario:
Initar, an IT security service company in New Jersey, provides 24/7 cloud and IT infrastructure support to mid-sized companies. Recognizing the need for a robust business continuity strategy, Initar transitioned from informal business continuity planning to implementing a BCMS based on ISO 22301.
During the BCMS implementation, a major nonconformity was identified: the BIA report lacked a defined Maximum Tolerable Period of Disruption (MTPD), which is required by ISO 22301. The corrective action process began with the IT team conducting a root cause analysis using a cause-and-effect diagram. Based on the analysis, an action plan was drafted to update all BIAs and establish the MTPD. The plan was approved by the head of the IT department, who monitored its implementation, while the internal auditor reviewed the effectiveness of the corrective action.
As stated in Scenario 7, Initar has adopted a preventive approach. As such, which of the following statements is correct?
A. The company reacts to business continuity incidents by eliminating them.
B. The company aims to eliminate the causes of adverse events.
C. The head of the IT Department closely monitors the implementation of corrective actions.
正解：B

質問 5：
An organization is being audited by an independent organization to ensure conformity to the specified criteri a. What type of audit is the organization conducting?
A. Second party
B. First party
C. Third party
正解：C

質問 6：
For which type of organizations is the standby arrangement approach appropriate when developing the BCM strategy?
A. Organizations that operate in more than one site since they can accommodate additional operations on short notice.
B. Organizations that operate in the service and manufacturing industry, which are predominantly people-intensive.
C. Organizations that have limited resources to maintain the standard level of delivery following an incident.
正解：A

質問 7：
An organization has implemented controls to prevent the unauthorized disclosure of documented information required by the BCMS. Is this in compliance with ISO 22301?
A. No, the protection of documented information against unauthorized disclosure is not required but it is a good practice to follow.
B. Yes, only if the documented information required by the BCMS is stored electronically.
C. Yes, documented information should be protected from loss of confidentiality.
正解：C