Question

During a disaster recovery review, an IS auditor finds that a critical order-processing database is backed up once every 24 hours via a nightly full backup. The business impact analysis (BIA) states that the maximum tolerable data loss for this system is 2 hours. Which conclusion should the auditor reach?

Accepted Answer

The current backup schedule cannot meet the defined recovery point objective and should be reported as a gap.

Answer

The backup arrangement is adequate because a full backup captures the entire database each night.

Answer

The recovery time objective is the primary concern and the backup frequency is irrelevant to data loss.

Answer

The 2-hour tolerance refers to system availability, so nightly backups satisfy the requirement.