ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
An IS auditor is evaluating an organization's disaster recovery plan (DRP) for its critical systems. The DRP includes a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour for the primary transaction processing system. Which of the following is the MOST important control to ensure these objectives are achievable?
- AAnnual DRP testing with all critical personnel.
- BDetailed documentation of all system configurations and dependencies.
- CA contract with a hot site provider for immediate failover.
- DRegular full data backups taken at least every hour.
Show answer & explanationAnswer & explanation
Correct answer: A. Annual DRP testing with all critical personnel.
While all options contribute to disaster recovery, regular, comprehensive DRP testing (including critical personnel) is the MOST important control for ensuring that the RTO and RPO are genuinely achievable in a real disaster. Testing identifies gaps, validates procedures, and ensures staff proficiency, which are critical for meeting time-sensitive recovery objectives.
Why the other options are wrong
- B. Documentation is essential but passive; it doesn't actively ensure the recovery objectives can be met without being put into practice through testing.
- C. A hot site helps achieve the RTO, but its effectiveness still depends on the recovery procedures and personnel's ability to use it, which is validated through testing.
- D. Hourly backups support the RPO, but don't ensure the RTO can be met or that the recovery process works.
DRP Testing
The systematic process of simulating a disaster scenario to validate the effectiveness of a disaster recovery plan, identify weaknesses, and train personnel.
- Crucial for validating RTO/RPO.
- Identifies gaps in procedures.
- Ensures staff readiness and proficiency.
Memory trick: Don't just plan, 'TEST' your might!