ISACA Certified Information Systems Auditor (CISA) ExamDomain 4: Information Systems Operations and Business ResilienceMedium
An IS auditor is reviewing an organization's business continuity plan (BCP) and notes that the plan includes a Recovery Point Objective (RPO) of four hours for its critical financial transaction system. However, the current backup frequency for this system is once every 24 hours. What is the MOST likely consequence of this discrepancy in the event of a disaster?
- AThe backup media will be insufficient to store all required data.
- BThe organization will incur excessive costs for data recovery.
- CThe organization will experience significant data loss, exceeding the RPO.
- DThe recovery of the system will exceed the RTO.
Show answer & explanationAnswer & explanation
Correct answer: C. The organization will experience significant data loss, exceeding the RPO.
RPO defines the maximum tolerable data loss. If the RPO is 4 hours but backups are only taken every 24 hours, then in a disaster, up to 24 hours of data could be lost, which clearly exceeds the 4-hour RPO. This discrepancy means the organization cannot meet its data loss tolerance.
Why the other options are wrong
- A. Backup frequency is about how often data is saved, not the total volume, so media insufficiency is not the direct consequence.
- B. Cost is not directly implied by the RPO/backup frequency mismatch; the primary issue is data loss.
- D. RPO relates to data loss, while RTO relates to downtime. While an RPO breach can impact recovery time, exceeding the RTO is not the direct and most likely consequence of this specific RPO/backup mismatch.
Recovery Point Objective (RPO)
The maximum tolerable amount of data that can be lost from an IT service due to a major incident.
- Measured in time (e.g., 4 hours, 1 day).
- Determines backup frequency and replication strategies.
- Directly impacts potential data loss.
Memory trick: RPO is your data loss limit; backups must meet it, or data will fritter.