ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITHard

An organization relies heavily on a single, highly customized legacy system for its core business operations. The disaster recovery plan (DRP) primarily focuses on restoring data backups to new hardware. Which of the following is the MOST critical missing element in this DRP?

  1. AProcedures for off-site data storage.
  2. BInclusion of non-IT business process recovery.
  3. CA strategy for acquiring compatible hardware for the legacy system.
  4. DRegular testing and validation of the DRP.
Show answer & explanation

Correct answer: C. A strategy for acquiring compatible hardware for the legacy system.

For a highly customized legacy system, simply restoring data to 'new hardware' is insufficient. The critical missing element is a specific strategy for acquiring *compatible* hardware and ensuring the legacy software can run on it, given the challenges often associated with legacy systems (e.g., outdated operating systems, proprietary components, vendor support issues). Without this, data restoration alone is useless.

Why the other options are wrong

  • A. Off-site storage is a good practice for data protection, but the question implies data backups exist; the issue is restoring them to a functional system.
  • B. While non-IT process recovery is important for a complete BCP, the question specifically highlights a DRP for IT systems and the challenge of a 'highly customized legacy system' where the issue is technical system recovery.
  • D. Testing is crucial, but the question points to a fundamental flaw in the *content* of the DRP, not just its validation.

Legacy System DRP Challenges

Specific difficulties encountered when developing and implementing Disaster Recovery Plans for older, highly customized IT systems, often due to unique hardware/software dependencies and lack of vendor support.

  • Hardware compatibility is a major hurdle.
  • Reliance on specialized skills.
  • Limited vendor support for older versions.

Memory trick: Restoring old data on new tech is like putting a square peg in a round hole.

More Domain 2: Governance and Management of IT questions