Security Operations · Topic 8 of 9
Disaster Recovery and Business Continuity Exercises
Disaster recovery processes and roles, declaring a disaster, communications, restoration and return, DR plan test types, and business continuity exercises.
- 4 min
- Includes a diagram
- Damage assessment comes before the decision to relocate.
- Declare a disaster when waiting would break the RTO.
- Return the least critical functions to the primary site first.
What it is
Disaster recovery (DR) restores IT systems and data after a major disruption. Business continuity (BC) keeps critical business functions running throughout. Plans only work if they are tested and people know their roles, so testing and exercises are as important as the plans themselves.
How it works
DR process elements
| Element | Content |
|---|---|
| Response | Initial actions to protect people and limit damage |
| Personnel | Named teams and roles: crisis management, recovery, salvage, communications |
| Communications | Call trees and notification tools that work when normal systems are down; out-of-band contact data kept current |
| Assessment | Damage assessment and estimated repair time, which drive the decision to relocate |
| Restoration | Recover systems by priority from the BIA |
| Training and awareness | Everyone knows their role and where the plan is |
| Lessons learned | Review and revise the plan after every event and test |
Declaring a disaster
The decision to fail over uses the damage assessment, the RTO and the time failover takes. If waiting longer would make the RTO impossible, declare now rather than hoping for an optimistic restoration estimate.
Work backwards from the RTO. If the outage is 2.5 hours old, the RTO is 6 hours and failover takes 3 hours, waiting another hour misses the RTO (2.5 + 1 + 3 = 6.5 hours). Declare and fail over.
Returning to the primary site
When the primary is restored, move the least critical functions back first. If the repaired site has problems, they appear without risking critical operations. The most critical functions move last, once the site is proven.
Keeping the plan usable
- Store copies offsite and in places the team can reach when the primary site and its systems are down.
- Keep contact data synchronized with HR records.
- Update the plan after significant changes such as acquisitions, new systems or replication changes; make recovery impact part of change management.
DR plan test types
| Test | Description | Disruption |
|---|---|---|
| Read-through / tabletop | Team members review the plan, alone or together around a table, for accuracy | None |
| Walkthrough | The team walks through a scenario step by step | None |
| Simulation | A scenario is played out more realistically, possibly using some systems | Low |
| Parallel | Systems are brought up at the alternate site while production continues | Low |
| Full interruption | Production is shut down and moved to the alternate site | High; rarely used |
Business continuity planning and exercises
BC planning covers people, processes and suppliers as well as IT. Exercises (tabletop, functional, full-scale) test whether managers know their roles and whether workarounds function. A plan that assumes loss of a building may fail when the real problem is loss of people, as in a pandemic: cross-training and remote work address that.
Third parties
Where a provider runs a critical service, review its recovery test results against your RTO rather than relying on contract promises or service credits.
How the exam asks about this
- "Managers know where the plan is but not their roles." Role-based training and tabletop exercises.
- "Which test runs the alternate site alongside production?" A parallel test.
- "The call tree failed because personal numbers had changed." Keep out-of-band contact data synchronized with HR records.
What to remember for the exam
- Damage assessment comes before the decision to relocate.
- Declare a disaster when waiting would break the RTO.
- Return the least critical functions to the primary site first.
- Tests from least to most disruptive: read-through, walkthrough, simulation, parallel, full interruption.
- BC exercises check people and processes; plans must cover loss of people, not just buildings.
A full interruption test can itself cause an outage. Use it only with strong justification and management approval.
Common mistakes
Returning critical systems first to an unproven primary site.
Keeping the only copy of the DR plan on systems that may be down.
Treating service credits as recovery assurance.
Check yourself
Which DR test is most disruptive?
The full interruption test.
Which functions should move back to the restored primary site first?
The least critical functions.
What should the DR team complete before deciding whether to move to the alternate site?
A damage assessment with an estimate of repair time.
Topic 8 of 9 in Security Operations
Test yourself on Security Operations
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.