Which control area is responsible for Contingency Planning?

• A. Contingency Planning
• B. Incident Response
• C. Maintenance
• D. Physical and Environmental Protection

Answer: (A)

Contingency planning focuses on establishing and maintaining plans to continue operations during disruptions. The control area dedicated to this is responsible for developing, documenting, testing, and updating the contingency plans, including backup procedures, alternate processing sites, recovery objectives, and the training and exercises needed to activate and implement those plans. This makes it the natural home for activities that ensure an organization can continue essential functions and recover quickly after an incident.

Incident response handles how to detect, respond to, and recover from security incidents in real time, which is about handling events as they occur rather than planning for ongoing continuity. Maintenance is about keeping systems up to date and functioning, not about overarching continuity planning. Physical and environmental protection focuses on safeguarding facilities and hardware from physical or environmental threats, not on the overarching process of maintaining operational continuity.