The correct answer is Business Continuity Plan (BCP) because the question specifically asks for the document that ensures services remain available (operational) during or in the event of an incident.
* Business Continuity Plan (BCP): This is the overarching plan focused on keeping the business running . It identifies mission-critical functions and outlines the procedures (such as failover to a hot site, manual workarounds, or redundant systems) to ensure those services are available to customers and users despite the incident. Its primary goal is availability and continuity of operations.
* Disaster Recovery Plan (DRP): This focuses on the technical restoration of IT systems after they have failed or been disrupted. While DRP supports BCP, its specific goal is " recovery " (getting systems back up) rather than " continuity " (keeping them from going down or maintaining service levels).
* B. Vulnerability management plan: This is a proactive process for identifying and patching weaknesses to prevent attacks, not a reactive plan to ensure availability during an active incident.
* C. Disaster recovery plan: As noted above, this is a subset of BCP focused on restoring data and infrastructure after a failure, whereas BCP focuses on maintaining the availability of the critical service itself.
* D. Asset management plan: This tracks hardware and software inventory but does not define procedures for maintaining availability during a crisis.