During a disaster recovery test, the information security manager observes that a critical order-processing system was restored and made operational within 5 hours, meeting its documented 6-hour recovery time objective (RTO). However, the recovered database was missing the last 3 hours of transactions before the outage, while the documented recovery point objective (RPO) for that system is 30 minutes. Which of the following is the MOST important conclusion the security manager should draw from this test result?