Operations and Business Resilience · Topic 8 of 8
Disaster Recovery Plans and Testing
IT disaster recovery plans, alternate sites from mirrored to cold, reciprocal agreements, recovery teams and the types of disaster recovery tests.
- 4 min
- Includes a diagram
- Site choice follows the RTO: mirrored, hot, warm, cold in order of speed.
- Reciprocal agreements are cheap but unreliable.
- Test types: checklist, walkthrough, simulation, parallel, full interruption.
What it is
A disaster recovery plan (DRP) sets out how IT systems, data and infrastructure are restored after a major disruption, within the recovery objectives the business impact analysis set. The BCP keeps the business running; the DRP brings back the technology that the business processes depend on.
How it works
Recovery strategies and alternate sites
| Site | Description | Recovery speed | Cost |
|---|---|---|---|
| Mirrored or duplicate site | Fully equipped, data replicated in real time, can take over almost at once | Fastest | Highest |
| Hot site | Equipped with hardware, network and software; needs current data loaded | Hours | High |
| Warm site | Partly equipped, for example network and some hardware | Days | Moderate |
| Cold site | Space, power and environmental controls only | Weeks | Low |
| Mobile site | Transportable facility delivered where needed | Varies | Moderate |
| Reciprocal agreement | Two organizations agree to host each other | Uncertain | Low |
| Cloud recovery | Systems recovered in a cloud provider's infrastructure | Can be fast if prepared | Pay for use |
The choice follows the RTO and RPO: an RTO of hours rules out a cold site. Reciprocal agreements are rarely reliable because the partner's spare capacity, compatibility and willingness are hard to guarantee and test.
Contracts for commercial sites should cover how many customers can use the site at once (oversubscription), the time allowed for occupancy, testing rights and security.
Contents of a DRP
- Criteria and authority for declaring a disaster.
- Recovery teams with roles, deputies and contact details.
- Priorities and sequence for restoring systems, based on the BIA.
- Step-by-step technical recovery procedures.
- Location of backups, keys, licenses and documentation.
- Vendor and supplier contacts and contracts.
- Procedures for returning to the primary site.
Testing the plan
| Test | What happens | Disruption |
|---|---|---|
| Checklist (desk) review | Team members check the plan for completeness and accuracy | None |
| Structured walkthrough or tabletop | Teams talk through a scenario step by step | None |
| Simulation | A realistic scenario is played out, without actually failing over | Low |
| Parallel test | Systems are recovered at the alternate site and process real or test data while production keeps running | Low |
| Full interruption test | Production is shut down and operations move to the alternate site | High, used rarely |
Tests should have defined objectives, be observed, compare results with the RTO and RPO, and produce a report with corrective actions. Plans that pass only paper tests may still fail in a real recovery.
When the business wants to prove the alternate site can handle real processing without any risk to production, the answer is a parallel test, not a full interruption test.
What the auditor checks
- The DRP covers the systems the BIA rated critical, in the right order.
- The recovery strategy can meet the agreed RTO and RPO.
- Tests are regular, realistic and followed by fixes.
- Off-site copies of the plan, backups and keys are available.
How the exam asks about this
- "RTO is four hours. Which site is suitable?" A hot site or better.
- "Which test proves recovery without interrupting production?" A parallel test.
- "What is the main weakness of a reciprocal agreement?" The partner may not have capacity or compatible systems when needed.
What to remember for the exam
- Site choice follows the RTO: mirrored, hot, warm, cold in order of speed.
- Reciprocal agreements are cheap but unreliable.
- Test types: checklist, walkthrough, simulation, parallel, full interruption.
- Every test needs objectives, results against RTO and RPO, and follow-up.
- Restore in priority order based on the BIA.
A full interruption test can itself cause a disaster. Use it only when lower-risk tests have succeeded and management has approved it.
Common mistakes
Choosing a site on cost alone, ignoring the RTO.
Testing only on paper. Technical recovery must be proven.
Forgetting the return to the primary site.
Check yourself
Which alternate site has only space, power and environmental controls?
A cold site.
What is the main difference between a parallel test and a full interruption test?
A parallel test runs recovery systems alongside production; a full interruption test shuts production down.
What should determine the choice of recovery site?
The recovery time and recovery point objectives from the business impact analysis.
Topic 8 of 8 in Operations and Business Resilience
Test yourself on Operations and Business Resilience
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.