Recovery Planning & Testing Flashcards

Which factor most critically determines the appropriate recovery site tier (hot/warm/cold) for a business process?

Answer: The process's RTO and RPO requirements

RTO and RPO drive site tier selection—tight RTOs require hot sites with pre-configured systems, while longer RTOs can tolerate cold sites requiring build-out time.

What is the purpose of 'exercising to failure' in BC testing?

Answer: To intentionally push beyond known limits to discover hidden vulnerabilities

Exercising to failure deliberately stresses the plan beyond normal boundaries to uncover gaps and weaknesses that routine tests would not reveal.

A plan specifies that backup media must be stored at least 50 miles from the primary site. What risk does this address?

Answer: Co-location risk from regional disasters affecting both primary and backup media

Offsite distance requirements ensure that regional disasters (hurricanes, floods) cannot simultaneously destroy both primary operations and backup copies.

In BC plan maintenance, what triggers an 'unscheduled review' outside the normal annual cycle?

Answer: A significant organizational change, incident, or major exercise finding

Significant changes—mergers, new critical systems, major incidents, or exercise-identified gaps—should trigger an unscheduled plan review to maintain accuracy.

What does 'time-to-competency' measure in the context of recovery team readiness?

Answer: The time required for recovery personnel to perform their roles effectively after activation

Time-to-competency measures how quickly activated recovery team members can perform their assigned tasks effectively, highlighting training and onboarding gaps.

Which component of a recovery plan specifically addresses how the organization will communicate with customers and the media during a disruption?

Answer: Crisis communication plan

The crisis communication plan defines messages, spokespersons, and channels for external stakeholder communication during an incident, protecting the organization's reputation.

Under ISO 22301, which clause requires organizations to evaluate BC performance and the effectiveness of the BCMS?

Answer: Clause 9 – Performance Evaluation

ISO 22301 Clause 9 requires monitoring, measurement, analysis, and evaluation of BCMS performance, including internal audits and management reviews.