Workshop  ›  Lessons  ›  Lesson 6

Day 4 — Morning · Domain 4B

Business Resilience — Part B

When systems fail — and they will — organizations that planned survive. Domain 4B is the auditor's guide to evaluating whether the organization can absorb disruption and recover: impact analysis, resilient architecture, backups, business continuity, and disaster recovery.

Session: Morning, Day 4 Duration: ~3 hrs Exam Weight: 26% (Domain 4) Knowledge Check: 5 Questions

Overview

Plan, prove, recover — in that order

Part B completes Domain 4 with resilience. It begins with the Business Impact Analysis, which sets the recovery targets (RTO and RPO) that everything else must meet, then moves through resilient architecture, backups, the Business Continuity Plan, and the Disaster Recovery Plan. The exam's relentless theme here is evidence over assumption: a plan that has never been tested — or whose tested capability doesn't meet the BIA's requirements — is a finding, not a reassurance. “We have a DRP” means nothing without documented test results showing it works.

Learning Objectives

By the end of this lesson you will be able to…

Key Terms

Vocabulary flashcards

👈 Read the term, recall the definition, then click or press Enter to check yourself.

Lesson Content

Study the material

1

Business Impact Analysis

Business resilience starts with knowing what matters most. The BIA identifies critical business functions, quantifies the impact of losing them over time, and sets the recovery targets (RTO and RPO) that every downstream plan must meet.

  • Method: identify processes & owners → interview → map dependencies (IT, staff, vendors, facilities, data) → quantify impact by time interval → set MTPD/RTO/RPO → rank by criticality → map to IT systems.
  • Impact dimensions: financial (lost revenue, fines), operational, reputational, regulatory.
  • RTO = maximum time to restore (e.g., 4 hours); RPO = maximum acceptable data loss in time (e.g., 1 hour → backups at least hourly).
  • Auditor: BIA documented and approved; updated within ~12–18 months; all critical processes (not just IT) covered; DRP capabilities align to BIA RTO/RPO; process owners involved.
Disruption / outage MTPD — maximum tolerable disruption time RPO max data loss RTO recovery target Last good backup Systems restored Impact unacceptable
Recovery objectives on one timeline: RPO is the acceptable data-loss window (it sets your backup frequency), RTO is the acceptable downtime to restore — and the RTO must fit inside the MTPD, the point where the impact becomes unacceptable.
💡 Exam TipThe BIA drives everything else. If it's outdated, incomplete, or misaligned to system capabilities, the BCP and DRP are built on sand. Always check whether the DRP's recovery capabilities meet the BIA-defined RTOs and RPOs — misalignment is a critical finding.

Try it — does the recovery solution meet the BIA?

The timeline above is fixed. Here it is live: set the recovery objectives the BIA demands, choose a backup schedule and recovery site, and watch where the data-loss (RPO) and downtime (RTO) windows fall against those targets. The auditor's core test — do the DRP's actual capabilities meet the BIA's requirements?

Interactive · adjust & explore
Set it up

The BIA sets the targets; your solution has to meet them.

Recovery objectives — from the BIA
4 h
How much data the business can afford to lose.
8 h
Downtime limit — must sit within the MTPD.
$50,000
Business impact per hour of outage.
Your recovery solution
RPO 6 h
Sets your actual RPO — worst case is one full interval of data.
RTO 2 h
Sets your actual RTO — colder sites cost less but recover slower.
The verdict
Actual RPO
—
 
Actual RTO
—
 
Est. outage cost
—
at this RTO
Annual solution cost
—
site + backups
— — Adjust the controls to test the plan against the BIA.
One disruption on a timeline

Red = data lost since the last good backup (RPO); blue = downtime to restore (RTO). Dashed lines are the BIA targets — a window crossing its target is a finding.

Data loss (RPO) Downtime (RTO) BIA target
🔎 In practice

Missing a target is a finding — but comfortably beating both targets while paying for an active-active site can be over-investment the BIA doesn't justify. The auditor's job is alignment: recovery capability matched to documented business need, proven by test results — not the most expensive option, and never an untested assumption.

2

System & Operational Resilience

Resilience is built into the architecture so a single failure doesn't become an outage. The auditor's test: capabilities verified by testing, not assumed from design.

  • Architectures: HA clustering, load balancing, geographic redundancy (separate sites); active-active (both live, immediate failover) vs. active-passive (standby requires activation).
  • Redundant infrastructure: power (UPS, dual feeds, generators), network (dual ISPs, BGP, diverse paths), storage (RAID, synchronous replication).
  • Testing: failover testing and chaos engineering (intentional fault injection).
  • Auditor: single points of failure identified and addressed; geographic redundancy for critical systems; mechanisms tested regularly; recovery capability verified by testing, not assumed.
3

Data Backup, Storage & Restoration

Backups are the last line of defense — but only if they can actually be restored. Restoration testing is the single most important backup control.

  • Types: full (slow create, fast restore), incremental (fast create, slow restore), differential (in between).
  • Storage: on-site (fast but shares the disaster), off-site (geographic separation), air-gapped/offline (ransomware protection).
  • Retention: Grandfather-Father-Son (GFS) schedules aligned to regulation and RPO.
  • Backups are encrypted, access-controlled, and securely transported off-site.
  • Auditor: schedules aligned to RPO; off-site/geo-separate storage; restoration tests performed and documented; backups encrypted; access controls prevent unauthorized restore or deletion.
💡 Exam TipThe most common backup deficiency on the exam: backups taken regularly but never tested for restoration. Organizations discover failed backups exactly when they need them. If restoration testing isn't documented, the backup program cannot be considered effective — no matter how often backups run.
Explore furtherRansomware — an interactive module on attack progression and mitigation; air-gapped backups are a key defense.
Ransomware ↗
4

Business Continuity Plan

The BCP is broader than IT — it covers people, facilities, communications, and how the whole business keeps running through disruption.

  • Components: policy & scope, BIA results, recovery strategies, emergency response (life safety first), crisis communication (internal and external), alternate work arrangements, vendor/supply-chain continuity, named roles, activation criteria.
  • Crisis communication: call trees, media relations, regulatory notification, stakeholder templates.
  • Maintenance: annual review plus trigger-based updates (major changes, incidents, test failures) and version control.
🔎 In practice

Supply-chain resilience is now a core BCP consideration: map critical vendors and their concentration and fourth-party dependencies, require continuity and RTO commitments in contracts, and pre-arrange alternates for single points of failure. On the communications side, a mature crisis-comms plan pre-approves holding statements, names a single spokesperson, and sets an update cadence — so the response is fast and consistent rather than improvised under pressure.

Test TypeRiskValue
Tabletop exerciseNoneIdentifies gaps in understanding
Structured walk-throughMinimalValidates plan completeness
SimulationLowTests decision-making under a scenario
Parallel testModerateValidates recovery capability alongside production
Full interruptionHighMost realistic validation; production taken offline
💡 Exam TipBCP testing frequency is a frequent topic; annual is the minimum for most organizations. The key word in test findings is “documented” — auditors can't rely on management statements that tests occurred. An undocumented test equals no test from an audit perspective.
💡 Exam TipBCP and DRP have different owners: the business continuity team owns the BCP (people, facilities, communications, processes), while IT owns the DRP (systems, applications, data recovery). The DRP is the technical subset of the BCP — a tested distinction.
5

Disaster Recovery Plan

The DRP is the technical subset of the BCP — how IT systems, applications, and data are recovered. Its credibility lives or dies on test results.

  • Components: recovery-site option, system recovery procedures, prioritized recovery sequence (per BIA), recovery team roles and contacts, vendor escalation, data restoration, validation testing, return-to-primary procedures.
  • Testing: validate actual RTOs/RPOs; a full test at least annually for critical systems; document RTO achieved vs. RTO required.
  • Auditor: procedures complete and accurate; tested RTO/RPO meet BIA requirements; a named owner; regular documented tests; gaps tracked to remediation; recovery personnel trained.
Recovery SiteDescriptionRTOCost
Hot siteFull replica with real-time syncMinutes–hoursVery high
Warm sitePre-configured hardware; data restoration neededHours–daysModerate
Cold siteSpace & infrastructure only; equipment must be procuredDays–weeksLow
Cloud DR (DRaaS)Recovery in the cloud; elastic capacityVariablePay-per-use
ReciprocalMutual-use agreement with another organizationVariableLow (capacity not guaranteed)
💡 Exam TipA DRP that has never been tested is a theoretical document. The strongest evidence it works is test results showing critical systems recovered within RTO/RPO. If a test shows the RTO was not met, that is an immediate finding — not a qualification.

Scored Knowledge Check

Test your Domain 4B judgment

Select the best answer for each question, then submit for your score and the rationale for every item. Hold the line on evidence: tested capability vs. BIA requirement.

Q1.The BIA gives the order-management system an RTO of 4 hours. The DRP, tested repeatedly, consistently recovers it in 10–12 hours. The auditor should:

Question 1 options
Correct: B. When the tested recovery capability (10–12 hours) does not meet the BIA-defined RTO (4 hours), it's a critical finding. The auditor should not recommend weakening the BIA to match the DRP — that would erase the accountability the BIA creates. Why the others fall short: A accepting 10–12 hours ignores the business-set 4-hour RTO; C raising the BIA to fit the DRP inverts the relationship — the BIA drives the RTO; D mandating a hot site prescribes a fix; the finding is the capability gap.

Q2.An organization runs nightly full backups to an off-site vault, but restoration has never been tested. The auditor's MOST significant concern is:

Question 2 options
Correct: C. The primary risk is that backups have never been proven to work. All other concerns (frequency, security, encryption) are secondary to the fundamental question of whether the backup program is functional. Why the others fall short: A backup frequency is secondary if restores are never proven; B vault security matters less than whether backups can be recovered at all; D encryption is secondary to recoverability.

Q3.During a BCP tabletop exercise, several team members don't know their roles and the contact list includes people who left 18 months ago. The MOST significant finding is:

Question 3 options
Correct: B. The BCP has not been maintained — personnel changes aren't reflected and members don't know their roles. A plan that describes an organization that no longer exists cannot be effective. Why the others fall short: A the tabletop succeeded — it surfaced the real problem; C more testing won’t fix an unmaintained plan; D delegating contact lists to HR sidesteps plan-maintenance ownership.

Q4.The primary data center sits in a flood plain; the recovery site is 2 miles away. The auditor's MOST significant concern is:

Question 4 options
Correct: A. A recovery site 2 miles away in the same flood plain may be in the same flood zone, so one disaster could take out both sites. Geographic diversity is a core resilience requirement; proximity defeats the purpose of a recovery site. Why the others fall short: B the RTO framing misses that both sites can flood together; C a missing contract is lesser than shared-disaster exposure; D there’s no fixed ‘ISACA distance’ — the concern is common-disaster risk.

Q5.A “warm” recovery site has servers pre-installed, but data must be restored from nightly off-site backups (~8 hours). The BIA requires a 1-hour RPO. The auditor should identify:

Question 5 options
Correct: B. A warm site fed by nightly off-site backups cannot achieve a 1-hour RPO — restored data could be up to ~24 hours old. Meeting a 1-hour RPO requires near-real-time replication, such as a hot site with synchronous or near-synchronous replication. Why the others fall short: A ‘a warm site suits most cases’ ignores this 1-hour RPO; C the transport-time framing misses the RPO gap; D the vault contract isn’t the issue — data currency is.