A Business Continuity Plan (BCP) or Disaster Recovery (DR) plan is particularly useful for determining the relative importance of organizational entities because these documents identify business-critical services, recovery priorities, dependencies, and acceptable disruption thresholds . Those characteristics translate directly into security risk prioritization.

For example, two servers may exhibit identical suspicious authentication behavior, but one may support a Tier-1 payment-processing application while the other supports a low-impact internal service. A BCP/DR plan typically identifies which system requires faster recovery, has stricter Recovery Time Objectives (RTOs), or supports critical business functions. Detection engineers can use that context when designing Risk-Based Alerting , asset priority, and Risk Factors.

Infrastructure and application architecture diagrams are valuable for identifying dependencies and communication paths, but they do not necessarily document business priority . An organization chart identifies reporting relationships rather than the criticality of technical entities.

The uploaded study material supports the broader principle that risk should be contextualized using asset criticality and business impact, although this exact question is not included verbatim in the supplied 60-question set.

Study Guide topics: asset criticality, business impact, risk prioritization, Risk Factors, BCP/DR, contextual security engineering.