Certified Information Systems Auditor (CISA) | Domain 4 Business Continuity and Resilience 02

The BIA establishes the critical processes, the impact of an outage, the dependencies and the recovery priorities.

RTO is the target time that can be tolerated between the loss of service and its restoration.

RPO expresses, in time, the extent of data loss tolerated as the point of recovery.

Process owners understand best the impact of an outage, the manual workarounds, the dependencies and the recovery priorities.

A hot site suits a short RTO, but it is generally expensive.

A test involving real processing verifies the technology, the procedures, the people and the dependencies together.

Beyond a successful backup, it must be tested that the data can be restored correctly when needed.

Enough geographic separation is needed to avoid correlated regional disasters.

Set out who is authorised, the contacts and the alternative channels so that consistent, accurate information is provided in good time.

Discussion following a scenario uncovers gaps in communication, decision-making, responsibility and the plan.

A UPS rides through momentary interruptions and buys time to shut down or switch to emergency power.

Reflect changes in the organisation and its dependencies, test results and the lessons of incidents in the plan.

Separate, immutable copies reduce the risk of an attacker encrypting or deleting them at the same time.