ISACA Certified Information Systems Auditor (CISA) ExamDomain 4: Information Systems Operations and Business ResilienceHard
An IS auditor is reviewing an organization's business continuity plan (BCP). The auditor discovers that the BCP relies heavily on a third-party hot site for disaster recovery, but the contract with the hot site vendor has not been reviewed or updated in five years. What is the MOST significant risk this poses to the organization's business resilience?
- AThe organization may be unable to recover its critical operations within its RTO.
- BThe hot site may no longer meet the organization's current technology requirements.
- CThe third-party vendor may have gone out of business or changed ownership.
- DService level agreements (SLAs) within the contract may be outdated or unenforced.
Show answer & explanationAnswer & explanation
Correct answer: A. The organization may be unable to recover its critical operations within its RTO.
An outdated contract, especially one that hasn't been reviewed for five years, risks the hot site no longer being able to support the organization's current needs or even being available. This directly jeopardizes the ability to recover critical operations within the defined RTO, which is the ultimate goal of disaster recovery.
Why the other options are wrong
- B. This is a plausible risk, but it's a specific manifestation of the broader issue that the hot site might not be functional for recovery.
- C. While possible, the contract's age alone doesn't confirm the vendor is out of business, but it highlights the lack of due diligence. The ultimate impact is still the failure to recover.
- D. Outdated SLAs are a concern, but the inability to recover at all (due to an unviable contract) is a more fundamental risk than just unmet service levels.
Hot Site
A fully equipped off-site data center that can be used immediately or with minimal setup for disaster recovery, providing a near real-time recovery capability.
- Provides the fastest recovery time among recovery site options.
- Requires significant upfront and ongoing costs.
- Relies heavily on robust contracts and regular testing with the provider.
Memory trick: An old hot site contract is like an old fire extinguisher; it might not work when you need it most.