Business Continuity and Disaster Recovery for DISA
BIA first, then RPO and RTO, then the site and the test. Here's the whole chain.
A business continuity plan (BCP) keeps critical business functions running through a disruption. A disaster recovery plan (DRP) restores the IT systems those functions depend on. DR is a subset of BCP: a bank can have its core banking back at the DR site and still fail customers if branch staff have no instructions.
Both start from a business impact analysis, and both are only as good as their last test. That is where an IS auditor spends most of the time.
You save ₹450
- Full-length timed mocks
- Module-wise practice
- Emerging-tech coverage
One payment, no subscription · Valid for 2 months
The Recovery Metrics
- Business impact analysis (BIA)
- Identifies critical functions, the facilities and systems they need, their interdependencies, and the order and time within which each must be recovered. It sets the numbers below.
- Recovery time objective (RTO)
- The target time within which a product, service or activity must be resumed or resources recovered. Lower RTO means faster recovery and higher cost.
- Recovery point objective (RPO)
- The maximum data loss acceptable, measured back in time from the incident. An RPO of 15 minutes means backups or replication must be no more than 15 minutes behind.
- Maximum tolerable period of disruption (MTPD)
- The longest an outage can last before the organisation's objectives or survival are threatened. Also called maximum acceptable outage (MAO) or maximum tolerable outage. RTO must be shorter than MTPD.
- Minimum business continuity objective (MBCO)
- The minimum level of service acceptable during a disruption, used to set what the recovered service must deliver.
Recovery Site Types
Mirror (active) site
What is ready
Fully redundant duplicate running in parallel
Recovery speed
Near immediate
Cost
Highest
Hot site
What is ready
Fully equipped facility with systems and near-current data; real-time sync possible
Recovery speed
Hours or less
Cost
High
Warm site
What is ready
Hardware and connectivity in place, smaller scale; backups present but may be days old
Recovery speed
Days
Cost
Medium
Cold site
What is ready
Space and basic utilities only; no hardware or data
Recovery speed
Longest
Cost
Lowest
| Site | What is ready | Recovery speed | Cost |
|---|---|---|---|
| Mirror (active) site | Fully redundant duplicate running in parallel | Near immediate | Highest |
| Hot site | Fully equipped facility with systems and near-current data; real-time sync possible | Hours or less | High |
| Warm site | Hardware and connectivity in place, smaller scale; backups present but may be days old | Days | Medium |
| Cold site | Space and basic utilities only; no hardware or data | Longest | Lowest |
The Five BCP Test Types
In rising order of realism and risk, as listed in the ISA 3.0 material:
- 1
Checklist test
Plan copies are circulated for review. A preliminary step, not a satisfactory test on its own.
- 2
Structured walkthrough
Business unit managers walk through the plan step by step in a meeting.
- 3
Simulation test
Operational and support staff rehearse a simulated disaster, without actual recovery or alternate processing.
- 4
Parallel test
Systems are brought up at the alternate site and process alongside production, and results are compared. Production does not stop.
- 5
Full interruption test
Production is actually shut down and the plan run as if real. The best proof and the riskiest test.
Quick practice on audit concepts. No signup.
RBI's Current DR Rules for Commercial Banks
Under RBI's 2026 Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions (31 July 2026): the BCP and DR policy should adopt best practices such as ISO 22301; DR drills for critical systems at least half-yearly; DR testing must run the DR site as primary for at least a full working day, beginning of day to end of day; backups must be periodically restored to prove they work; critical systems should target a minimal RTO approved by the IT Strategy Committee and a near-zero RPO; a documented reconciliation method is needed where RPO is not zero; and DC and DR configurations and patches must be identical. The ITSC reviews BCP and DR at least annually.
How the DISA Assessment Test Tests This
- check_circleSequence questions: the BIA comes first. Choosing a recovery strategy or site before the BIA is the trap.
- check_circleRPO is about data, RTO is about time to resume. Options that swap them are common distractors.
- check_circle"Most common" DR test in the material is the parallel test; "best" but riskiest is the full interruption test; the checklist test alone is not adequate.
- check_circleLife safety first: in any emergency question, protecting people beats protecting data or equipment.
- check_circleStandards drift: the ISA 3.0 material quotes ISO 22301:2012. The current edition is ISO 22301:2019.
FAQs
What is the difference between BCP and DRP?expand_more
BCP keeps the business operating through a disruption, covering people, processes, premises and communication. DRP restores IT systems and data. DRP is one part of BCP.
What is the difference between RPO and RTO?expand_more
RPO is how much data, measured in time, you can afford to lose. RTO is how quickly the service must be back. A bank's core banking might need an RPO close to zero and an RTO measured in hours.
What is the difference between a hot site, a warm site and a cold site?expand_more
A hot site has equipment and near-current data and can run within hours. A warm site has equipment and connectivity but older or partial data. A cold site is just space and utilities, so recovery takes longest.
How often must banks conduct DR drills?expand_more
For commercial banks, RBI's 2026 Directions require DR drills for critical information systems at least every six months, and for other systems as the bank's risk assessment decides.
Next steps
- IT Risk Managementarrow_forward
- Incident Responsearrow_forward
- IS Operationsarrow_forward
- Syllabusarrow_forward
Assessment Test format, timed and scored.