CISA Practice Question: Information Systems Operations and Business Resilience
An organization's business continuity plan (BCP) includes alternate facilities that can be operational within 24 hours. The maximum tolerable downtime (MTD) for a critical process is 12 hours. What is the most significant gap?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The alternate facility cannot be activated within the required MTD.
The alternate facility recovery time (24 hours) exceeds the MTD (12 hours), meaning the process would fail its recovery requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The BCP does not include customer communication procedures.
Why it's wrong here
While customer communication procedures are a valid BCP component, the most significant gap is that the alternate facilities require 24 hours to become operational, yet the MTD for the critical process is only 12 hours. This option is tempting because communication plans are essential for stakeholder notification during a disaster, and in a scenario where recovery time objectives were already met, missing procedures would indeed be the primary gap.
- ✓
The alternate facility cannot be activated within the required MTD.
Why this is correct
The alternate facility needs 24 hours to become operational, but the critical process tolerates only 12 hours of downtime, so recovery exceeds the MTD by 12 hours. The gap is the mismatch between facility activation time and the required recovery timeframe.
- ✗
The BCP does not address data backup procedures.
Why it's wrong here
Backup procedures matter, yet the stem's stated mismatch is timing: 24-hour facility activation versus a 12-hour MTD. Missing backup detail does not explain that 12-hour shortfall. Addressing backup procedures would be the correct focus where recovery point, not recovery time, is the unaddressed requirement.
- ✗
The recovery time objective (RTO) for the process is not defined.
Why it's wrong here
Defining an RTO is good practise, but the stem already supplies the binding constraint: MTD of 12 hours against 24-hour facility activation. An undefined RTO is a documentation gap; the 12-hour shortfall is the actual exposure. RTO definition would be the priority where no recovery target exists at all.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.