2.5. Personnel Security and Business Continuity
💡 First Principle: The most sophisticated technical security program can be undermined by a single disgruntled employee, a careless new hire, or a business process that continues operating when the underlying business function that justifies it has changed. Personnel security manages the human risk that technology cannot fully address; business continuity ensures the organization survives disruptions that technology cannot prevent.
Personnel security and business continuity are grouped together in Domain 1 because both require administrative — not technical — thinking. Firewalls don't prevent disgruntled employees from abusing authorized access. Encryption doesn't keep the business running when the data center floods. These require policies, processes, tested plans, and human judgment.
Why this matters: The exam regularly presents scenario questions about what to do when an employee is terminated (access revocation sequence), what BIA outputs feed into BCP, and what the difference between BCP and DRP is. Getting the process sequence right is critical — these are scenario-based "what should you do FIRST" questions.
⚠️ Common Misconception: Many candidates conflate BCP and DRP. Business Continuity Planning maintains critical business functions during any major disruption (broad scope, strategic). Disaster Recovery Planning restores specific IT systems and data after a disaster (narrow scope, technical). BCP asks "how do we keep operating?" DRP asks "how do we restore the IT systems that support operations?" BCP is the parent; DRP is a component of it.
