Which of the following is NOT a step in the Contingency Planning Process?

• A. Develop Contingency Plan Policy
• B. Conduct BIA
• C. Identify Preventative Controls
• D. Implement Business Continuity Testing

Answer: (D)

The Contingency Planning Process centers on creating a governance and planning framework before an incident occurs. Establishing a contingency planning policy sets the rules and authority for continuity efforts. Conducting a Business Impact Analysis identifies critical functions, dependencies, and how long those functions can be interrupted. Identifying preventative controls focuses on reducing risk before events happen by implementing safeguards and mitigations. The activity of implementing business continuity testing is about validating and exercising the plan to ensure it works, which is a verification/validation step rather than a core planning step. While testing is essential, it sits in the testing, training, and exercises phase that follows the planning activities, so it is not one of the planning steps themselves.