An IS auditor is reviewing an organization's disaster recovery plan (DRP). The auditor notes that the DRP includes detailed procedures for restoring critical systems and data, but lacks specific guidance on how to manage external dependencies, such as third-party cloud providers, payment gateways, and telecommunication services, during a disaster. What is the PRIMARY risk associated with this finding?
- AThe cost of recovering external services may exceed the allocated disaster recovery budget.
- BInternal recovery teams may not have the necessary technical skills to manage third-party services.
- CThe organization's DRP may not be fully executable if external services are unavailable or unresponsive.
- DFailure to notify third-party providers promptly could result in contractual penalties.
Show answer & explanationAnswer & explanation
Correct answer: C. The organization's DRP may not be fully executable if external services are unavailable or unresponsive.
Modern IT environments heavily rely on external services. A DRP that fails to account for these critical dependencies, including communication protocols, recovery procedures, and potential service level agreement (SLA) impacts, renders the entire recovery effort vulnerable. Even if internal systems are restored, the business cannot function without these external components.
Why the other options are wrong
- A. Budgetary concerns are important, but the immediate and primary risk is the operational failure to recover due to unmanaged dependencies.
- B. While skill gaps can be an issue, the primary risk is the lack of a plan for these dependencies, regardless of internal skill sets.
- D. Contractual penalties are a financial risk, but the primary concern of a DRP is business continuity and the ability to restore operations.
External Dependency Management (DRP)
Managing external dependencies in a Disaster Recovery Plan (DRP) involves identifying critical third-party services, understanding their recovery capabilities, establishing communication protocols, and integrating their recovery into the overall DRP.
- Crucial for modern hybrid IT environments.
- Includes cloud providers, telecom, payment gateways.
- Requires clear communication and coordination plans.
Memory trick: DRP: Don't Rely Purely on Internal Parts