ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITHard
An organization relies on a highly customized, mission-critical application developed in-house over 20 years ago. The original developers have long since left the company, and documentation is sparse. The organization's disaster recovery plan (DRP) lists this application as critical but provides only generic restoration steps. What is the MOST significant challenge this poses to the DRP's effectiveness?
- AHigh probability of recovery failures due to lack of specialized knowledge.
- BIncreased licensing costs for legacy operating systems and databases.
- CInability to accurately estimate recovery time objectives (RTOs) for the application.
- DDifficulty in identifying and procuring compatible hardware for recovery.
Show answer & explanationAnswer & explanation
Correct answer: A. High probability of recovery failures due to lack of specialized knowledge.
Given the application's age, customization, lack of original developers, and sparse documentation, the most significant challenge is the high likelihood that recovery efforts will fail due to the absence of the specific, specialized knowledge required to effectively restore and configure such a unique and complex legacy system. Generic steps are insufficient.
Why the other options are wrong
- B. Licensing costs are a financial concern, not a direct impediment to the *effectiveness* of the recovery process itself.
- C. RTOs can still be estimated, even if inaccurately. The core problem is the ability to meet *any* RTO if the recovery fails.
- D. While possible, identifying compatible hardware is a logistical challenge; the deeper issue is knowing *how* to use it effectively with the application.
Legacy System DRP Challenges
Difficulties in developing and executing a Disaster Recovery Plan (DRP) for older, highly customized, or poorly documented systems, often due to lack of expertise, compatible hardware, or insufficient documentation.
- Knowledge drain is a major risk.
- Hardware/software compatibility issues.
- Generic DRP steps are insufficient.
Memory trick: Old systems, new problems for DRP.