Which of the following defines the triggers within a business continuity plan (BCP)?

A. Disaster recovery plan B. Needs of the organization C. Gap analysis D. Information security policy

Correct Answer: ???????????

________________________________ Note The official answer (but it could be wrong because it is not provided by ISACA) is: "D. Information security policy" Other experts claim that the correct answer is: "A. Disaster recovery plan" Some of my reflections: 1) The official answer (option D) could certainly be correct if instead "information security policy" was "Business Continuity Policy". In any case, option D makes a minimum of sense than all other options. 2) Option A seems to me more the "effect" than the "cause".

What is the best answer in your opinion? An explanation is most definitely welcome.

Many thanks