ISACA Certified Information Systems Auditor (CISA) ExamDomain 4: Information Systems Operations and Business ResilienceMedium
An IS auditor is reviewing the organization's business continuity plan (BCP). The auditor notes that while the BCP documents recovery procedures for critical IT systems, it lacks detailed instructions for restoring data from off-site backups to the recovery site. What is the MOST significant implication of this omission?
- AIncreased risk of data corruption during the recovery process.
- BInability to accurately calculate the recovery point objective (RPO).
- CDelays in achieving the recovery time objective (RTO) for critical systems.
- DFailure to meet regulatory compliance requirements for data protection.
Show answer & explanationAnswer & explanation
Correct answer: C. Delays in achieving the recovery time objective (RTO) for critical systems.
Without detailed instructions for restoring data from off-site backups, the actual process of getting data back onto systems at the recovery site will be ad-hoc and prone to delays, directly impacting the ability to meet the RTO.
Why the other options are wrong
- A. While a risk, the primary and most direct implication is the delay in recovery and failure to meet time objectives, rather than guaranteed corruption.
- B. RPO is about the acceptable data loss, which is defined before recovery and not directly impacted by missing restoration instructions.
- D. While compliance is a concern, the direct operational impact of missing restoration steps is more critical in a disaster.
Recovery Time Objective (RTO)
The maximum acceptable duration of time that a business process or system can be unavailable after an incident or disaster before significant damage occurs.
- Focuses on 'time to restore'.
- A key metric for business continuity planning.
- Determined by business impact analysis.
Memory trick: No map to restore data means a long, slow road back to normal.