Technology and Security · Topic 5 of 7
Technology Resilience and Disaster Response and Recovery
CRISC technology resilience: redundancy and high availability, backup types and immutable copies, hot, warm and cold sites, and DR plan testing.
- 5 min
- Resilience design reduces outages; DR restores service after them.
- RTO and RPO from the BIA drive backup frequency and site choice.
- Incremental restores need every increment; differential needs only the latest one.
What it is
Technology resilience is the ability of systems to resist, absorb and recover from disruption. It combines design choices that avoid outages, such as redundancy, with recovery capabilities for when outages happen anyway.
Disaster response and recovery is the set of plans and capabilities that restore IT services after a major disruption, within the recovery time and recovery point objectives that the business impact analysis set. The DRP supports the business continuity plan.
How it works
Resilience by design
| Technique | What it does |
|---|---|
| Redundancy | Duplicate components so one failure does not stop the service |
| High availability clustering | Automatic failover between servers |
| Geographic distribution | Copies of services in separate locations or cloud regions |
| Load balancing | Spreads traffic and removes failed nodes |
| Capacity management | Avoids outages caused by demand peaks |
| Removing single points of failure | Finds components, links, suppliers or people that everything depends on |
The level of resilience should match the business need. Building near-zero downtime for a low-impact system wastes money; under-investing in a critical one creates unacceptable risk.
Backups
| Type | Copies | Restore |
|---|---|---|
| Full | All selected data | Fastest restore; most storage |
| Incremental | Changes since the last backup of any type | Needs the full plus every incremental since |
| Differential | Changes since the last full backup | Needs the full plus the latest differential |
A common rule of thumb is 3-2-1: three copies of data, on two different types of media, with one copy off site. Against ransomware, at least one copy should be offline or immutable, so attackers with admin access cannot delete or encrypt it. Backups must be tested by restoring, not just by checking the job completed.
Backup frequency must support the RPO. A nightly backup cannot meet an RPO of 15 minutes; that needs replication or frequent log backups.
Recovery sites
| Site | Readiness | Recovery time | Cost |
|---|---|---|---|
| Mirrored or active-active | Fully running copy | Near immediate | Highest |
| Hot site | Equipped and current, ready to run | Hours | High |
| Warm site | Partly equipped; needs data and setup | Days | Medium |
| Cold site | Space and power only | Weeks | Low |
Cloud services allow recovery environments to be created on demand, which can lower cost, but the plan must still be tested and the cloud dependency itself assessed. Reciprocal agreements with another organization are cheap but hard to rely on and rarely tested.
The disaster recovery plan
A DRP defines who declares a disaster, the recovery team and contacts, the recovery order based on business priorities and dependencies, step-by-step procedures, communication, and how to return to normal operations. It must be kept current as systems change; an outdated DRP fails at the worst moment.
Testing
DR tests range from document reviews and tabletop exercises to restores of single systems, parallel tests and full failovers. Each test records results against RTO and RPO, gaps found and actions. Tests should cover realistic scenarios, including ransomware, where the recovery environment and backups may themselves be targets.
Ransomware resilience
Recovering from ransomware differs from recovering from a fire. Attackers may have been inside for weeks, so restoring the latest backup can restore their access too. Plans need clean, verified backups, a way to rebuild identity systems, and forensic checks before reconnection.
A worked example
A logistics firm's BIA sets an RTO of 4 hours and an RPO of 1 hour for its warehouse management system. The DRP relies on nightly backups to a disk array in the same data centre, with recovery to a cold site.
The practitioner reports that neither objective can be met: nightly backups give up to 24 hours of data loss, and a cold site takes weeks. The business owner chooses database replication to a cloud region and a warm standby environment, plus an immutable backup copy. A failover test six weeks later restores service in 3 hours with 10 minutes of data loss.
How the exam asks about this
- "What is the BEST way to confirm backups can be used for recovery?" Perform regular test restores.
- "Which recovery site is MOST appropriate for a system with an RTO of a few hours?" A hot site or equivalent.
- "What is the MOST important control to protect backups from ransomware?" Keep at least one copy offline or immutable, separate from production credentials.
What to remember for the exam
- Resilience design reduces outages; DR restores service after them.
- RTO and RPO from the BIA drive backup frequency and site choice.
- Incremental restores need every increment; differential needs only the latest one.
- Hot sites recover in hours, warm in days, cold in weeks.
- Test backups by restoring; keep an offline or immutable copy.
A backup job that reports success is not proof of recovery. The exam favours evidence from an actual restore test over job logs or vendor assurances.
Common mistakes
Choosing a site without checking the RTO. A cold site cannot meet an RTO measured in hours.
Keeping backups on the same network and credentials as production. Ransomware can destroy them too.
Letting the DRP fall behind system changes. New systems and dependencies must be added as they go live.
Check yourself
What does the 3-2-1 backup rule mean?
Keep three copies of data on two different types of media, with one copy stored off site.
Why can a nightly backup fail to meet business needs?
If the RPO is shorter than 24 hours, a nightly backup could lose more data than the business can accept.
What makes ransomware recovery different from other disasters?
Attackers may have compromised systems and backups for some time, so clean, verified backups and rebuilt identity systems are needed before reconnecting.
Topic 5 of 7 in Technology and Security
Test yourself on Technology and Security
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.