Exam CISA topic 1 question 1402 discussion

I vote for D. While restore tests (option C.) are a general requirement for a backup implementation, this is specifically about disaster case. From my understanding of the ISACA way of thinking, whenever an area is narrowed down in the question, an answer specific to that area is expected. In addition, ISACA also describes the following requirement summarized in the article "How to Develop and Execute a Rigorous Data Backup and Recovery Strategy" from 18.04.2022: The most crucial control to ensure an organization can recover its data from backup media in case of a disaster is to follow the 3-2-1 rule. This rule states that organizations should maintain at least 3 copies or versions of data stored on 2 different pieces of media, with 1 copy being offsite. This approach helps reduce the risk of data disruption and ensures that there are multiple backups available for recovery purposes.

However, while storing backup media offsite is crucial, it alone does not guarantee successful data recovery. Without periodically testing the restoration process (option C), there is a risk that the backup media stored offsite may be corrupted, outdated, or incomplete. Regular testing ensures that the backup media is viable and that the organization can recover its data effectively when needed. Therefore, while option D is an essential control, option C (periodically restoring backup media for key databases) is considered more crucial because it directly verifies the integrity and effectiveness of the backup and recovery process.

D , since for a disaster, onsite backup and restoration should not be done. Offsite is the key.