ISACA Certified Information Systems Auditor (CISA) ExamDomain 1: Information System Auditing ProcessMedium
An IS auditor is reviewing an organization's business continuity plan (BCP) and disaster recovery plan (DRP). The organization relies heavily on a third-party cloud provider for its critical applications and data storage. The auditor notes that the BCP/DRP primarily focuses on on-premise infrastructure recovery and lacks specific provisions for cloud service outages. What is the MOST significant risk introduced by this deficiency?
- AInability to meet regulatory compliance requirements for data residency.
- BUnauthorized access to sensitive data stored in the cloud environment.
- CProlonged disruption of critical business operations during a cloud outage.
- DIncreased cost of cloud services due to inadequate resource planning.
Show answer & explanationAnswer & explanation
Correct answer: C. Prolonged disruption of critical business operations during a cloud outage.
The primary purpose of a BCP/DRP is to ensure the continuity of critical business operations and recovery from disruptive events. A BCP/DRP that fails to address cloud service outages, despite heavy reliance on cloud providers, directly risks prolonged disruption of critical business operations, which is a core BCP/DRP objective.
Why the other options are wrong
- A. Data residency is a compliance issue, but the lack of cloud outage provisions directly impacts operational recovery, which is more fundamental to BCP/DRP.
- B. Unauthorized access is a security risk, which should be addressed, but the scenario focuses on the *continuity* plan's failure to address *outages*.
- D. Increased costs might be a consequence, but not the most significant risk related to business continuity.
BCP/DRP in Cloud Environments
Business Continuity Plans (BCPs) and Disaster Recovery Plans (DRPs) must explicitly address the unique challenges and dependencies associated with cloud service providers, including service outages, data recovery from the cloud, and failover strategies.
- Cloud reliance shifts some BCP/DRP responsibilities to the provider.
- Organizations must understand the cloud provider's BCP/DRP capabilities (e.g., via SOC reports).
- Lack of cloud-specific provisions can lead to significant operational downtime.
Memory trick: Cloud Outage: Plan or Face Long Delays!