Question

A hospital's business continuity plan is being revised after a ransomware incident forced a full recovery from backups. During recovery, teams restored systems alphabetically, which delayed the electronic health record (EHR) system and its authentication dependency for over 14 hours while a low-priority reporting server came online first. The CISO wants to prevent this during the next event. Which action MOST directly addresses the failure demonstrated during this recovery?

Accepted Answer

Define a recovery sequence in the disaster recovery plan based on business impact analysis, tiering systems by RTO and mapping upstream dependencies before restore order is set

Answer

Decrease the backup RPO by increasing snapshot frequency so less data is lost during the next ransomware event

Answer

Migrate all backups to immutable object storage with an air-gapped copy to prevent encryption of recovery media

Answer

Increase backup verification frequency by running monthly integrity checks against restore images