ISC2 Certified in Cybersecurity (CC)Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) ConceptsMedium
An organization's business continuity plan includes regular exercises. During a recent exercise, the team discovered that the recovery procedures for a critical database were outdated and failed to restore data correctly. What is the primary purpose of conducting such exercises, as demonstrated by this discovery?
- ATo meet compliance requirements
- BTo minimize the cost of disaster recovery solutions
- CTo train new employees on recovery procedures
- DTo identify weaknesses and validate the plan's effectiveness
Show answer & explanationAnswer & explanation
Correct answer: D. To identify weaknesses and validate the plan's effectiveness
The primary purpose of BC/DR exercises is to test the plan's effectiveness, identify any gaps or weaknesses (like outdated procedures), and validate that it meets the organization's recovery objectives. The discovery of outdated procedures directly illustrates this purpose.
Why the other options are wrong
- A. While exercises help with compliance, the core purpose is operational validation, not just checking a box.
- B. Exercises are an investment and typically increase, not minimize, the cost of DR solutions by revealing needs for improvement.
- C. Training is a secondary benefit; the main goal is to find flaws in the plan itself.
Testing BC/DR Plans
The process of regularly exercising business continuity and disaster recovery plans to identify deficiencies, validate procedures, and ensure the plan's effectiveness in meeting recovery objectives.
- Can range from tabletop exercises to full-scale simulations.
- Essential for maintaining plan relevance and readiness.
- Often leads to plan updates and improvements.
Memory trick: Test, Test, 1-2-3: Find the flaws before disaster strikes me!