In continuity planning, what identifies the mission-critical activities that must continue under all conditions?

• A. A formal continuity plan identifying recovery time objectives.
• B. Mission-critical activities identified through a business impact analysis that must continue under all conditions.
• C. A recovery checklist used after incidents.
• D. A general risk assessment without priority ranking.

Answer: (B)

In continuity planning, the essential step is identifying which functions must keep operating by conducting a business impact analysis. The BIA examines how disruptions affect each business function, determines which activities are mission-critical, and specifies the resources, timeframes, and dependencies needed to sustain them. This process directly yields the objectives and priorities that ensure those critical activities can continue under all conditions, making them the focus of the continuity strategy. While recovery time objectives and recovery checklists are important parts of planning, they don’t by themselves identify which activities are truly mission-critical through the lens of impact and resilience. A general risk assessment without prioritization likewise doesn’t establish the specific, must-do functions that must endure during a disruption.