What happens to a company when its main computer system catches fire or a flood destroys its data centre? The exam objective 4.2 tests your understanding of how organisations plan to keep running through a crisis and how they bounce back afterwards. This concept matters because the CISA exam will ask you to evaluate whether these plans are realistic, complete, and actually workable when disaster strikes.
Jump to a section
A simple way to picture Business Resilience and Disaster Recovery
A small electrical fire starts in the office kitchen toaster. This leads to the sprinkler system activating, which floods the entire kitchen and soaks the carpets in the nearby server room. The company's daily operations grind to a halt because the main server hosting the email system is water damaged. Business resilience means the office had a fire extinguisher under the sink, a fire blanket on the wall, and a clear evacuation plan. Disaster recovery means after the fire is out and the water is cleaned up, the IT team pulls a backup server out of a storage cupboard, plugs it in, and restores the emails from a copy saved on an external hard drive kept in a manager's safe. Resilience is about preventing the fire from destroying the whole building. Recovery is about how you get back to normal after the fire trucks leave. The office manager who organises fire drills and maintains the extinguisher is the business continuity planner. The technician who restores the server from backup is the disaster recovery specialist. Both roles are essential for the office to survive and reopen quickly.
Business Resilience and Disaster Recovery are two sides of the same coin. Think of Business Resilience as the overall ability of an organisation to keep delivering its products or services, no matter what goes wrong. It is a broad concept that includes everything from having backup generators to training staff to work from home. Disaster Recovery is a specific subset of resilience. It focuses purely on the technology: restoring computer systems, networks, and data after a major failure or disaster.
An IT professional uses a formal document called a Business Continuity Plan (BCP) to map out resilience. This plan covers the whole organisation. It lists critical business processes, the people needed to run them, and the minimum resources required. The Disaster Recovery Plan (DRP) is a separate, more technical document that lives inside the BCP. The DRP tells the IT team exactly how to recover servers, databases, and communication tools.
Key terms you will see on the exam:
Recovery Time Objective (RTO): This is the maximum acceptable time to get a system back up after it fails. For a bank's payment processing system, the RTO might be minutes. For a company's internal staff directory, it might be 24 hours.
Recovery Point Objective (RPO): This measures how much data loss is acceptable. If the RPO is 1 hour, the company can afford to lose at most one hour's worth of transactions. The backup system must take a copy of the data at least every hour.
Maximum Tolerable Downtime (MTD): This is the total time a business process can be down before the organisation suffers irreparable damage. It is longer than the RTO because it includes the time needed to repair or rebuild the system, not just restore from backup.
Mean Time Between Failures (MTBF): This predicts how long a piece of equipment will run before it breaks. A server with an MTBF of 100,000 hours should run for about 11 years without failing.
Mean Time To Repair (MTTR): This estimates how long it takes to fix a failed component. A lower MTTR is better.
How does it all work in practice? The organisation starts by performing a Business Impact Analysis (BIA). This is a study that identifies which business functions are most critical and what would happen if they stopped. The BIA helps set the RTO and RPO for each system. High-priority systems get faster recovery targets. A hospital's patient records system would have an RTO of minutes, while the HR payroll system might have an RTO of 24 hours.
After the BIA, the organisation develops recovery strategies. Common strategies include:
Hot site: A fully equipped backup data centre that can take over operations within minutes or hours. It has all the hardware, software, and network connections ready.
Warm site: A partially equipped backup site with some hardware and network connections, but systems need to be configured and data restored before it is usable. Recovery takes longer.
Cold site: An empty building with power and cooling, but no equipment. You bring in all the hardware and software after a disaster. Recovery takes days or weeks.
Cloud-based recovery: Using cloud services to replicate systems and data. You spin up virtual servers in the cloud when the primary site fails.
Testing these plans is mandatory. A tabletop exercise involves key staff sitting in a room and talking through a disaster scenario step by step. A full simulation test actually shuts down a system or switches to backup to see if everything works. The exam expects you to know that the organisation must test the plan regularly and update it based on test results.
What did this replace? Before formal business continuity, many companies simply hoped nothing bad would happen. They relied on a single computer room and had no backups. A fire, flood, or power cut could put them out of business permanently. Modern regulations and insurance requirements now force companies to have documented, tested plans. The CISA exam will test whether you can spot a weak plan that looks good on paper but would fail in a real emergency.
Conduct Business Impact Analysis (BIA)
Identify which business processes are critical and what would happen if they stopped. Determine the financial and operational impact of downtime. This step sets the foundation for all recovery targets.
Define Recovery Objectives (RTO and RPO)
Set the maximum acceptable downtime (RTO) and maximum acceptable data loss (RPO) for each critical system. These must be approved by business leadership and align with the BIA findings.
Select Recovery Strategies
Choose the appropriate recovery site type (hot, warm, cold, or cloud) and backup methods (full, incremental, differential) based on the RTO and RPO. The strategy must be cost-effective and technically feasible.
Develop the Disaster Recovery Plan (DRP)
Write a detailed document specifying step-by-step procedures for recovering each system. Include contact lists, system configurations, and restoration sequences. Assign roles and responsibilities to specific team members.
Train Staff and Test the Plan
Train all personnel on their roles in the DRP. Conduct tabletop exercises and full simulation tests to validate the plan. Document test results and identify gaps for improvement.
Maintain and Update the Plan
Review and update the DRP at least annually or whenever significant changes occur (new systems, staff changes, or infrastructure upgrades). Incorporate lessons learned from tests and real incidents.
Consider a medium-sized retail company with an online store and three physical shops. The data centre hosting their e-commerce website and inventory database is in a basement office. One night, a burst water pipe floods the basement, destroying the server rack. The website goes offline, and the inventory system is inaccessible.
The IT manager is the person responsible for executing the Disaster Recovery Plan. She receives an alert from the monitoring system at 2:00 AM. She immediately contacts the on-call engineer and activates the DRP.
Here is the step-by-step process the IT team follows:
Assessment and declaration: The engineer arrives at the office and confirms the flood has destroyed the servers. The IT manager declares a disaster. This triggers the formal recovery process. She contacts the CEO and explains the situation.
Communication: The IT manager sends a pre-written notification to all employees via a group messaging app. The message says the website is down and instructs staff to refer customers to the physical shops. She also contacts the company's cloud provider and asks them to start up the backup virtual servers.
Activation of backup systems: The company has a warm site in a different city. The warm site has servers pre-installed with the operating system and core applications, but no current data. The IT team remotely connects to the warm site and begins restoring the most recent database backup from the encrypted backup file stored in a cloud storage bucket. The RPO for the inventory database is 4 hours, meaning they will lose the last four hours of orders placed before the flood.
Recovery: The database restore takes 90 minutes. The IT team then copies the latest website code from a version control repository and deploys it to the warm site web servers. The DNS records are updated to point the website's domain name to the warm site's IP address. This step takes another 30 minutes. The total downtime is 2 hours, which is within the RTO of 4 hours.
Verification: The IT manager tests the website by placing a test order and checking the inventory system. She confirms that sales transactions are processing correctly. She asks a customer service representative to log in and verify that customer records are accessible.
Post-recovery activities: The company later arranges for the original servers to be dried and repaired. The IT manager updates the DRP with lessons learned. She notes that the flood detection system in the basement was not working and adds it to the maintenance schedule.
The CISA auditor (that is what you are training to be) would review this scenario. They would check whether the DRP was tested within the last year. They would verify that the backup files are encrypted and stored in a separate location. They would ask about the communication plan and whether staff knew their roles. They would calculate whether the RTO and RPO targets are realistic compared to the actual recovery time.
The CISA exam tests Business Resilience and Disaster Recovery in the context of evaluating the design and effectiveness of the plans. You are not expected to write a full plan. You are expected to identify weaknesses and gaps.
Question types that appear frequently:
Scenario questions: The exam gives you a short story about a company that experiences a disaster. You must choose the best option from a list of actions. The correct answer is usually the one that matches the defined RTO or RPO. For example, if the RPO is 2 hours, the correct answer will involve restoring from the most recent backup taken within 2 hours.
Comparison questions: You will be asked to distinguish between RTO, RPO, MTD, and MTBF. A common trap is confusing RTO with RPO. Remember: RTO is about time to recovery. RPO is about data loss.
Best practice questions: The exam asks which testing method is most effective or which backup strategy is most appropriate for a given budget. The correct answer for testing is usually a full simulation test because it truly validates the plan. The trap is choosing a tabletop exercise as the most effective, but the exam considers it less rigorous.
Trap patterns to watch for:
The answer that says "test the plan" without specifying the method is too vague. The exam expects a specific testing method like "conduct a full simulation test."
The answer that suggests buying more expensive hardware when the real problem is a failure in planning or training. The correct answer usually involves updating the plan or retraining staff.
The answer that conflates backup with disaster recovery. A backup is just a copy of data. Disaster recovery includes the process and infrastructure to restore that data and make the system operational.
The answer that ignores the business impact. For example, restoring a low-priority system before a critical one is usually wrong.
Key concepts to memorise:
RTO vs RPO: RTO = time to recover. RPO = amount of data loss.
Business Impact Analysis (BIA) must be performed before setting RTO and RPO.
The recovery site type (hot, warm, cold) must match the RTO. A cold site cannot meet a one-hour RTO.
Testing must be documented. Undocumented tests are considered incomplete.
The plan must include a communication plan for notifying employees, customers, and regulators.
Backup media must be stored offsite, preferably in a different geographic region.
Common exam traps:
An answer that says "perform a risk assessment instead of a BIA" is a trap. Risk assessment identifies threats. BIA identifies critical processes. Both are needed, but the question usually asks about BIA.
An answer that suggests storing backups in the same building as the primary system is always wrong. Offsite storage is mandatory.
An answer that proposes a single point of failure, such as one person knowing the recovery process, is wrong. Plans should document roles and have backups for key personnel.
RTO measures the maximum acceptable downtime for a system, while RPO measures the maximum acceptable data loss in time units.
A Business Impact Analysis (BIA) must be performed before setting recovery objectives to identify the most critical business processes.
Hot sites can meet short RTOs of minutes or hours, cold sites require days or weeks, and warm sites fall in between.
Disaster recovery plans must be tested at least annually, with the most rigorous test being a full simulation or parallel run.
Backup media must be stored offsite in a geographically separate location to survive a site-level disaster.
The disaster recovery plan is a subset of the broader business continuity plan and focuses exclusively on IT systems.
Recovery strategies must align with the defined RTO and RPO; using a cold site for a system with a 1-hour RTO is unacceptable.
All testing must be documented, and plan updates must be made based on test results and lessons learned.
These come up on the exam all the time. Here's how to tell them apart.
Business Continuity Plan (BCP)
Covers the entire organisation including people, facilities, and processes
Focuses on business operations and customer service
Includes communication plans, alternate work locations, and supply chain management
Disaster Recovery Plan (DRP)
Focuses only on IT systems and data recovery
Focuses on restoring servers, networks, and applications
Includes backup procedures, system restore steps, and technical configurations
Hot Site
Fully equipped with all hardware and software ready
Can take over operations in minutes to hours
High cost due to constant readiness
Cold Site
Empty building with no equipment
Requires days or weeks to become operational
Low cost but long recovery time
Recovery Time Objective (RTO)
Measures time to restore system functionality
Answer the question: how long can we be down?
Shorter RTO requires more expensive recovery solutions
Recovery Point Objective (RPO)
Measures acceptable data loss in time units
Answers the question: how much data can we lose?
Shorter RPO requires more frequent backups
Full Backup
Copies all data every time
Takes longest to create and restore
Provides complete data set from a single backup
Incremental Backup
Copies only data changed since last backup
Fast to create but slower to restore because all increments are needed
Requires the last full backup plus all subsequent incremental backups
Mistake
Disaster recovery is just about backing up data.
Correct
Disaster recovery includes restoring systems, networks, and applications, not just data. A backup file is useless without the hardware, software, and processes to restore it.
Beginners often equate backup with recovery because they have personal experience copying files to a USB drive. They do not realise that enterprise recovery involves rebuilding entire server environments.
Mistake
A business continuity plan is the same as a disaster recovery plan.
Correct
The business continuity plan (BCP) is broader and covers the whole organisation. The disaster recovery plan (DRP) is a subset of the BCP that focuses on IT systems and data recovery.
The terms are often used interchangeably in casual conversation, but the exam strictly distinguishes them.
Mistake
Cloud backups mean you never need to test recovery.
Correct
Cloud backups must still be tested regularly. A test might reveal that the cloud restore process is too slow or that the data is corrupt.
People assume cloud services are automatically reliable, but the cloud provider only guarantees uptime of the infrastructure, not the correctness of your data or the speed of your restore process.
Mistake
The RTO and RPO should be the same for all systems.
Correct
RTO and RPO must be set per system based on the business impact. A customer-facing payment system will have a much lower RTO than an internal staff training portal.
Beginners think a one-size-fits-all approach is simpler, but the exam emphasises that critical systems require faster recovery.
Mistake
A tabletop exercise is the most rigorous way to test a disaster recovery plan.
Correct
A full simulation test is more rigorous because it actually executes the recovery process under real conditions. A tabletop exercise is a discussion only.
Beginners think talking through a scenario is sufficient because it is easier to organise. The exam expects the most thorough testing method for critical systems.
Mistake
Disaster recovery only applies to natural disasters like floods or earthquakes.
Correct
Disaster recovery covers any event that causes major IT failure, including cyber attacks, power outages, equipment failures, human errors, and sabotage.
People focus on dramatic events and forget that common failures like a failed hard drive or a mistaken data deletion are equally covered by the DRP.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
RTO (Recovery Time Objective) is the maximum time you can afford to have a system down. RPO (Recovery Point Objective) is the maximum amount of data loss you can accept, measured in time. For example, an RPO of 1 hour means you can lose at most one hour's worth of transactions.
Yes. A Business Continuity Plan (BCP) covers the entire organisation including people, processes, and facilities. A Disaster Recovery Plan (DRP) is a specific part of the BCP that focuses only on restoring IT systems and data.
A hot site is a fully equipped backup data centre that has all the hardware, software, network connections, and data already in place. It can take over operations within minutes or hours after a disaster.
At least once per year, and more frequently for critical systems. The test should be a full simulation or parallel run to validate that the plan actually works under real conditions.
No. Backups must be stored offsite in a separate location to protect against site-level disasters like fires, floods, or power outages that could destroy both the primary and backup data.
A tabletop exercise is a discussion-based test where key stakeholders sit together and talk through a disaster scenario step by step. No actual systems are touched. It is useful for validating communication and decision-making but is not a substitute for a full simulation test.
You've finished Business Resilience and Disaster Recovery. Continue through the CISA study guide to build a complete picture of the exam.
Done with this chapter?