ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITHard
A CISA is auditing an organization's disaster recovery plan (DRP). The DRP specifies a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour for a critical financial application. However, the CISA observes that the current backup strategy only performs daily full backups, and the recovery procedures involve manual restoration processes that typically take 6-8 hours. What is the MOST critical finding for the CISA?
- AThe RPO cannot be achieved with daily full backups.
- BManual restoration processes introduce a high risk of human error.
- CThe DRP is inconsistent with the current backup and recovery capabilities.
- DThe RTO is too ambitious for the current IT infrastructure.
Show answer & explanationAnswer & explanation
Correct answer: C. The DRP is inconsistent with the current backup and recovery capabilities.
The most critical finding is the inconsistency between the stated RTO/RPO objectives in the DRP and the actual capabilities of the backup and recovery processes. The DRP is effectively a theoretical document that cannot be implemented as designed, leaving the organization vulnerable. The specific issues with RPO and RTO are symptoms of this underlying inconsistency.
Why the other options are wrong
- A. While true (daily backups mean an RPO of up to 24 hours), this is a symptom of the larger inconsistency.
- B. Human error is a risk, but the core issue is the plan's inability to meet its stated objectives, regardless of how efficient the manual process is.
- D. While true, this is a symptom of the larger inconsistency between the plan and capabilities.
DRP Consistency with Capabilities
Ensuring that a disaster recovery plan's stated objectives (RTO, RPO) are realistic and achievable given the organization's existing recovery strategies, technologies, and resources.
- Misalignment renders the DRP ineffective and misleading.
- Requires regular testing and validation of recovery capabilities.
- A critical aspect of DRP effectiveness and auditability.
Memory trick: A 'REAL' DRP ensures 'R'ecovery 'E'xpectations 'A'lign with 'L'ogistics.