An IS auditor is assessing the organization's disaster recovery plan (DRP). The DRP outlines detailed technical recovery steps for IT systems but does not address the business processes that rely on these systems. Which of the following is the MOST critical gap in the DRP?
- ALack of clear roles and responsibilities for IT recovery staff.
- BFailure to ensure the continuity of critical business operations.
- CInability to assess the financial impact of system downtime.
- DDifficulty in coordinating with external third-party vendors.
Show answer & explanationAnswer & explanation
Correct answer: B. Failure to ensure the continuity of critical business operations.
A DRP's ultimate goal is to ensure the continuity of critical business operations. While technical recovery is essential, without understanding how recovered IT systems support business processes, the organization may restore systems inefficiently or prioritize non-critical systems, leading to prolonged business disruption. This highlights a critical gap in linking IT recovery to actual business resilience.
Why the other options are wrong
- A. The scenario states detailed technical steps, implying IT staff roles are somewhat defined for those steps, but the broader business context is missing.
- C. Assessing financial impact is part of BIA, which informs DRP, but the gap described is about *how* to recover business, not impact assessment.
- D. Vendor coordination is important, but the fundamental issue is the internal alignment of IT recovery with business needs.
DRP Business Alignment Gap
A deficiency in a Disaster Recovery Plan where technical IT recovery procedures are defined, but the connection to critical business processes and their continuity is not adequately addressed.
- Prevents effective prioritization of IT recovery.
- Leads to prolonged business disruption post-IT recovery.
- Highlights the need for BCP and DRP integration.
Memory trick: Fixing the car engine but not knowing how to drive it to the destination.