CRISC: Certified in Risk and Information Systems ControlDemo

By Isaca · Question Mode

QuestionQ1375

Risk Response and Reporting

What is a risk practitioner’s BEST recommendation to management when test results indicate that the organization’s recovery time objective (RTO) cannot be achieved?

  • A Engage IT and the business to re-evaluate the RTO.
  • B Engage business users to develop and document alternative procedures.
  • C Adjust the recovery point objectives (RPOs) to align with the RTO.
  • D Revise the RTO in the business impact analysis (BIA).
Explanation

An RTO is the business-defined maximum time a function or resource may be unavailable before unacceptable impact occurs. A failed recovery test identifies a mismatch between that business requirement and IT’s recovery capability, so business and IT should jointly re-evaluate the RTO and the recovery approach. An RPO addresses acceptable data loss, not recovery duration, and the RTO should not simply be changed in the BIA without stakeholder reassessment.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!