In business continuity, how do exposure and vulnerability differ?

• A. Exposure is assets in harm's way; vulnerability is susceptibility to harm given exposure.
• B. Exposure is the probability of loss; vulnerability is the financial impact.
• C. Exposure is management's response; vulnerability is operational uptime.
• D. Exposure is the geographic location; vulnerability is the age of the asset.

Answer: (A)

In business continuity, exposure refers to assets, processes, or locations that could be harmed because they exist in the path of a threat. Vulnerability is how susceptible those exposed items are to harm once a threat occurs, and it depends on the strength of protections, redundancies, and preparedness in place.

So, exposure is about what could be affected, while vulnerability is about how weak or resistant those affected assets are to damage given that threat. This separation lets you decide where to act: reduce exposure by moving or diversifying assets, or reduce vulnerability by improving safeguards, backups, and resilience measures. For example, a data center in a flood-prone area has high exposure; if it lacks backups and redundant systems, its vulnerability is also high, increasing risk. Strengthening flood defenses and adding offsite backups reduces vulnerability and lowers risk, even if exposure remains the same.

The other options mix up concepts: exposure isn’t simply the probability of loss, and vulnerability isn’t just the financial impact or a non-structural attribute like management response or asset age alone.