SOC Business Continuity and Disaster Recovery 3

Question 1

What role does business continuity planning play within the SOC 2 control framework?

Accepted Answer

BCP directly supports the Availability criterion by ensuring systems can withstand and recover from disruptions

Answer

BCP is an optional control required only when customers contractually mandate it

Answer

BCP is classified as a financial reporting control evaluated exclusively under SOC 1

Answer

BCP applies only to physical security and falls outside the scope of logical access controls

Question 2

In disaster recovery, 'failover' refers to:

Accepted Answer

The automatic or manual switching of operations to a backup system when the primary fails

Answer

The planned shutdown and decommissioning of legacy systems after a migration

Answer

The process of archiving production data to cold storage at end-of-life

Answer

A post-incident review that analyzes root causes and documents lessons learned

Question 3

Which element is most essential in a business continuity communication plan?

Accepted Answer

Predefined escalation paths and contact lists for notifying stakeholders during incidents

Answer

A financial budget breakdown for all recovery operation expenses

Answer

Technical specifications for configuring backup hardware and network equipment

Answer

A historical log of prior SLA performance metrics for the past fiscal year

Question 4

A SOC 2 report identifies a 'complementary user entity control' (CUEC) related to disaster recovery. What obligation does this create for user organizations?

Accepted Answer

User organizations must implement their own specified complementary DR controls for the overall control structure to be effective

Answer

User organizations have no additional obligations since the service organization assumes full DR responsibility

Answer

User organizations must replicate the service organization's DR plan exactly at their own facilities

Answer

User organizations are released from their own DR requirements by the service organization's controls

Question 5

What is the primary purpose of a Plan of Action and Milestones (POA&M) following a DR test?

Accepted Answer

To document identified gaps, assign responsible owners, and establish remediation deadlines

Answer

To certify that the DR plan passed all criteria and is ready for executive sign-off

Answer

To document the total budget approved for the next cycle of DR testing

Answer

To calculate the per-hour cost of downtime experienced during the recovery test

Question 6

Under SOC 2 availability criteria, which scenario represents a control deficiency?

Accepted Answer

No documented process for restoring systems in the event of a complete data center failure

Answer

Systems achieving 99.97% uptime against a contractual 99.9% SLA commitment

Answer

Backup procedures tested quarterly with documented results retained for 12 months

Answer

A change management policy requiring dual approval for all production system changes

Question 7

What does geographic redundancy primarily provide in a business continuity program?

Accepted Answer

Protection against site-wide disasters by replicating operations across physically separate locations

Answer

Legal protection from liability when committed service levels are not met

Answer

A mechanism for distributing recovery costs across multiple business units or cost centers

Answer

Compliance with data sovereignty requirements when operating across international jurisdictions