An organization is evaluating its disaster recovery plan (DRP). The current DRP focuses primarily on restoring IT systems and data but does not explicitly address the recovery of specialized operational technology (OT) systems critical for manufacturing, which have unique hardware and software requirements. Which of the following is the MOST significant risk uncovered by this DRP deficiency?
- AFailure to meet regulatory compliance requirements for IT systems.
- BIncreased cost for DRP maintenance and testing.
- CProlonged disruption of core business operations.
- DDifficulty in integrating new IT technologies after a disaster.
Show answer & explanationAnswer & explanation
Correct answer: C. Prolonged disruption of core business operations.
If the DRP does not cover the recovery of critical OT systems, which are essential for manufacturing, the organization will be unable to resume its core business function even if IT systems are restored. This leads to a prolonged disruption of production and revenue generation, which is the most significant business impact. The DRP must align with all critical business functions.
Why the other options are wrong
- A. The deficiency is in OT, not IT. While OT can have compliance requirements, the direct and most significant risk is operational shutdown.
- B. While DRP maintenance has costs, the primary risk is the inability to recover core business operations.
- D. This is a secondary concern; the immediate and more significant risk is the inability to operate at all.
DRP Business Alignment
The principle that a Disaster Recovery Plan (DRP) must be fully integrated with and support the organization's overarching business continuity objectives, ensuring the recovery of all critical business functions, not just IT systems.
- Extends beyond IT to include processes, people, and facilities.
- Based on Business Impact Analysis (BIA) findings.
- Prioritizes recovery based on business criticality.
Memory trick: DRP Business: Recovery for the Whole Business Machine.