During a business continuity strategy assessment, a hospital's IT security officer reviews… — CompTIA Security+

During a business continuity strategy assessment, a hospital's IT security officer reviews the Business Impact Analysis (BIA) for the Electronic Health Record (EHR) system. The business impact analysis defines a Maximum Tolerable Downtime (MTD) of $12\text{ hours}$ . Technical server restoration and database mounting are calculated to have a Recovery Time Objective (RTO) of $8\text{ hours}$ . However, post-restoration operational steps—including data integrity validation, paper chart reconciliation, and system synchronization—require a Work Recovery Time (WRT) of $5\text{ hours}$ . Which of the following operational conclusions should the security officer draw regarding the current disaster recovery plan?

The disaster recovery plan is non-compliant because the combined outage and recovery timeframe ( $13\text{ hours}$ ) exceeds the Maximum Tolerable Downtime ( $12\text{ hours}$ ).Cevap
B
The disaster recovery plan is fully compliant because the Recovery Time Objective ( $8\text{ hours}$ ) is less than the Maximum Tolerable Downtime ( $12\text{ hours}$ ).
C
The plan is compliant if the Recovery Point Objective (RPO) is adjusted to $5\text{ hours}$ to absorb the Work Recovery Time.
D
The post-restoration verification process acts as a corrective control that automatically reduces the effective Recovery Time Objective to $3\text{ hours}$ .

Cevap

The disaster recovery plan is non-compliant because the combined outage and recovery timeframe (

13\text{ hours}

) exceeds the Maximum Tolerable Downtime (

12\text{ hours}

In Business Impact Analysis (BIA) and Business Continuity Management (BCM), Maximum Tolerable Downtime (MTD) defines the total permissible disruption period. Total operational recovery includes both technical system restoration (RTO) and operational business verification/reconciliation (WRT). Because

\text{RTO} + \text{WRT} = 8 + 5 = 13\text{ hours}

, the total recovery period exceeds the

12\text{ hour}

MTD, rendering the continuity plan non-compliant.

Adım Adım Çözüm

Identify the key BIA metrics given in the scenario

\text{MTD} = 12\text{ hours}

\text{RTO} = 8\text{ hours}

, and

\text{WRT} = 5\text{ hours}

Establishing the target threshold and component recovery durations is necessary to evaluate business continuity viability.

Calculate total operational outage duration

\text{Total Outage Duration} = \text{RTO} + \text{WRT} = 8\text{ hours} + 5\text{ hours} = 13\text{ hours}

System restoration is not complete when servers boot (RTO); full business operation requires data verification and reconciliation (WRT).

Compare total disruption time against Maximum Tolerable Downtime

13\text{ hours} > 12\text{ hours}

, indicating the business continuity plan fails to meet the required MTD constraint.

Any recovery timeframe where

\text{RTO} + \text{WRT} > \text{MTD}

places the enterprise at unacceptable operational risk.

Anahtar Kavram

Work Recovery Time (WRT) and Recovery Time Objective (RTO) relationship to Maximum Tolerable Downtime (MTD)

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru