Boot Camp  ›  Lessons  ›  Lesson 7

Day 4 — Afternoon · Domain 4 (30%)

Continuity & Recovery — Part B

Resilience is the manager’s job. Part B covers business continuity, disaster recovery, recovery objectives, and plan testing — ensuring the organization can absorb disruption and recover within the limits the business can tolerate.

Session: Afternoon, Day 4 Duration: ~3 hrs Exam Weight: 30% (Domain 4) Knowledge Check: 8 Questions

Overview

Plan to survive disruption and recover on time

Incidents end; disruption can be existential. Part B turns the manager toward resilience: the business impact analysis that defines what matters and how fast it must come back, the recovery objectives (RTO/RPO/MTD) that bound every strategy, the continuity and disaster-recovery options that meet them, and the testing that proves they actually work. The exam’s recurring lessons: the BIA drives everything, an untested plan or backup is worthless, and continuity is owned by the business while disaster recovery is owned by IT.

Learning Objectives

By the end of this lesson you will be able to…

Key Terms

Continuity & recovery vocabulary

👈 Tap a card to flip it. The BIA, the objectives, and the site options are exam staples.

Lesson Content

Study the material

1

Business Continuity & the BIA

Objective 1 · the BIA

Business continuity keeps the organization running through disruption. It begins with the business impact analysis, which identifies the organization’s critical processes, quantifies the impact of losing them over time, and derives the recovery objectives. Every continuity and recovery decision traces back to the BIA — build it first.

  • The BIA ranks processes by criticality and sets RTO/RPO from business needs, not IT preference.
  • BCP is enterprise-wide: people, facilities, communications, suppliers, and processes — not just systems.
  • Continuity strategies (alternate workspace, manual workarounds, supplier alternatives) flow from the BIA’s priorities.
  • Continuity is a business responsibility with executive sponsorship; security and IT enable it.
💡 Exam TipWhen a question asks what should be done first when building continuity or DR — or what determines the RTO/RPO — the answer is the business impact analysis. Objectives come from the business, via the BIA.
2

Recovery Objectives: RTO, RPO & MTD

Objective 2 · RTO, RPO and MTD

Recovery objectives are the numbers that bound every strategy. The RTO sets how fast a process must return; the RPO sets how much data loss is acceptable; the MTD is the outer limit beyond which harm becomes unacceptable.

  • RTO = maximum acceptable downtime; RPO = maximum acceptable data loss (in time).
  • RTO must be shorter than MTD — recovery has to finish before the tolerable-downtime limit.
  • A tight RPO drives the backup/replication approach: a 1-hour RPO cannot be met by nightly backups.
  • Objectives must be realistic and funded — an RTO the recovery strategy can’t actually achieve is a false assurance.
Disruption / outage MTD — maximum tolerable downtime time RPO max data loss RTO recovery target Last good backup Systems restored Impact unacceptable
Recovery objectives on one timeline: RPO is the acceptable data-loss window (it sets your backup frequency), RTO is the acceptable downtime to restore — and the RTO must fit inside the MTD (maximum tolerable downtime — ISO 22301 calls it the MTPD), the point where the impact becomes unacceptable.
🔎 In practice

The business sets a 1-hour RPO for the order system, but backups run nightly. That gap is the finding: a nightly backup permits up to ~24 hours of data loss. Meeting a 1-hour RPO requires near-continuous replication or hourly backups.

Try it — does the recovery strategy meet the objectives?

The BIA hands you the numbers: how much data loss (RPO) and downtime (RTO) the business can tolerate, with RTO fitting inside the MTD. Choose a backup schedule and a recovery site, and watch whether the strategy actually meets those targets — an objective the strategy can’t achieve is a false assurance.

Interactive · adjust & explore
Set it up

The BIA sets the targets; the strategy has to meet them.

Objectives — from the BIA
4 h
How much data the business can afford to lose.
8 h
Downtime limit — must sit within the MTD.
$50,000
Business impact per hour of outage.
Your recovery strategy
RPO 6 h
Sets your actual RPO — worst case is one full interval of data.
RTO 2 h
Sets your actual RTO — colder sites cost less but recover slower.
The verdict
Actual RPO
—
 
Actual RTO
—
 
Est. outage cost
—
at this RTO
Annual strategy cost
—
site + backups
— — Adjust the strategy to test it against the BIA.
One disruption on a timeline

Red = data lost since the last good backup (RPO); teal = downtime to restore (RTO). Dashed lines are the BIA targets — a window crossing its target is a finding.

Data loss (RPO) Downtime (RTO) BIA target
🔎 In practice

Missing a target is a finding — but comfortably beating both targets with an active-active site can be over-investment the BIA doesn’t justify. Recovery capability should match documented business need, proven by test results — and remember RTO must fit inside the MTD, or recovery finishes too late to matter.

3

Recovery Strategies & Sites

Objective 3 · recovery strategies and sites

Disaster recovery selects the strategy that meets the RTO/RPO at acceptable cost. Alternate-site choices trade speed for money — the right answer fits the recovery objectives and budget the BIA justifies, not the fastest option available.

StrategyRecovery speedCost / trade-off
Hot siteNear-immediateHighest cost; fully equipped and current
Warm siteHours to daysModerate; partly equipped, needs data/config
Cold siteDays to weeksLowest cost; space and power only
Mobile / cloudVariableFlexible; cloud DR can be fast and scalable
ReciprocalVariableCheap, but capacity/compatibility not guaranteed
💡 Exam TipThere is no universally ‘best’ site — match the strategy to the RTO/RPO and budget in the scenario. A hot site for a process with a one-week RTO is over-spending; a cold site for a one-hour RTO will fail.
4

Backups & Plan Testing

Objective 4 · plan testing

Plans and backups are worthless until proven. The manager ensures backups are validated by restoration and that the plans are exercised regularly, with results documented and weaknesses fed back into the plan.

  • Backups: full / incremental / differential, often a 3-2-1 strategy; a backup is only effective once a restore has been tested.
  • Test types, lowest to highest impact: checklist/desk review → structured walkthrough → simulation → parallel test → full-interruption test.
  • A parallel test validates recovery without disrupting production; a full-interruption test is the most thorough but the riskiest.
  • An undocumented test equals no test; plans are living documents, updated after every test, incident, and significant change.
🔎 In practice

‘Backups run nightly and complete successfully’ is not evidence of recoverability. Job success only proves the copy was made — the manager requires periodic, documented restore tests to confirm the data is actually usable.

5

Crisis Management & the Manager’s Role

Objective 5 · BC vs DR and crisis

Above the technical recovery sits crisis management — senior leadership coordinating the organization’s overall response, decisions, and communications. The security manager integrates incident, continuity, and recovery so they operate as one capability under crisis leadership.

🔎 In practice

Supply-chain resilience belongs in continuity planning: map critical vendors and their concentration and fourth-party dependencies, require continuity and RTO commitments in contracts, and pre-arrange alternates for single points of failure. Crisis communications should pre-approve holding statements, a single spokesperson, and an update cadence so the response stays fast and consistent under pressure.

  • Crisis management handles strategic decisions and stakeholder/public communication; DR and BCP execute beneath it.
  • Ownership: the business continuity team owns the BCP; IT owns the DRP — the security manager ensures they are aligned and tested together.
  • Continuity and recovery connect to incident management: a major incident can invoke the BCP/DRP.
  • The manager keeps plans current, funded, exercised, and aligned to the BIA as the business evolves.
💡 Exam TipRemember the split: BCP = business continuity team (people, facilities, processes); DRP = IT (systems, data). Crisis management sits above both, coordinating the enterprise response.

Scored Knowledge Check

Test your resilience judgment

Eight questions on continuity and recovery. Start from the BIA, respect the objectives, and prove the plan works.

Q1.What PRIMARILY determines a system’s recovery time and recovery point objectives?

Question 1 options
Correct: C. RTO and RPO are derived from business needs through the BIA, which ranks critical processes and the impact of their loss. They are business-driven objectives, not IT or vendor conveniences. Why the others fall short: A the backup schedule is a means, not the driver; B the DR vendor’s capability doesn’t set business objectives; D system age is irrelevant — the BIA sets RTO/RPO.

Q2.The business requires a recovery point objective (RPO) of one hour, but backups run only nightly. This is a problem because:

Question 2 options
Correct: D. RPO is the maximum acceptable data loss in time. Nightly backups can lose nearly a day of data, which cannot satisfy a one-hour RPO — near-continuous replication or hourly backups are needed. Why the others fall short: A ‘always unreliable’ overstates it; B RPO measures data loss, not downtime; C encryption is irrelevant to the RPO gap.

Q3.Which alternate site offers the FASTEST recovery, at the highest cost?

Question 3 options
Correct: C. A hot site is fully equipped and current, enabling near-immediate failover — the fastest and most expensive option. Cold sites are cheapest but slowest. Why the others fall short: A a cold site is slowest and cheapest; B a warm site is intermediate; D a reciprocal agreement offers no guaranteed capacity — a hot site is fastest.

Q4.When is a backup considered truly effective?

Question 4 options
Correct: A. Job success only proves a copy was made. Recoverability is confirmed only by a tested restore; without it, the backup is an untested assumption. Why the others fall short: B job completion proves a copy was made, not recoverability; C offsite storage doesn’t prove a restore works; D encryption doesn’t either — only a tested restore does.

Q5.Which disaster-recovery test validates recovery WITHOUT disrupting normal production operations?

Question 5 options
Correct: A. A parallel test recovers systems at the alternate site while production keeps running, validating recovery without interrupting the business. A full-interruption test is the most thorough but disrupts production. Why the others fall short: B a full-interruption test takes production offline; C a checklist review doesn’t validate recovery; D such a test does exist — the parallel test.

Q6.How do business continuity (BCP) and disaster recovery (DRP) plans relate?

Question 6 options
Correct: D. The BCP covers the whole organization (people, facilities, processes); the DRP is the IT-focused subset that restores systems and data. The business continuity team owns the BCP; IT owns the DRP. Why the others fall short: A they aren’t the same plan; B reverses the relationship; C the BCP isn’t IT-owned — the DRP is the IT subset of the enterprise BCP.

Q7.For a critical process, the relationship between RTO and MTD should be:

Question 7 options
Correct: B. Recovery must complete before harm becomes unacceptable, so the RTO must be shorter than the maximum tolerable downtime (MTD). An RTO longer than MTD guarantees unacceptable impact. Why the others fall short: A an RTO greater than MTD means recovery finishes too late; C equal leaves no margin; D they are related — recovery must complete before the tolerable limit.

Q8.During a major disruptive event, the senior-level coordination of the organization’s overall response and external communications is the role of:

Question 8 options
Correct: B. Crisis management is the senior-leadership function coordinating strategic decisions and stakeholder/public communication during a major event; DR and BCP execute the recovery beneath it. Why the others fall short: A the DR team handles technical recovery; C the help desk handles user support; D the backup admin handles backups — senior coordination is crisis management.