Translate business impact into recovery priorities, resilient backups, rehearsed continuity plans, and defensible evidence.
50 min 150 XPSkills: Business impact analysis, Recovery objectives, Continuity assurance
Brief
At Fenwick Dispatch, a fictional regional parts distributor, a storage failure stops order processing at 10:00. The operations manager says yesterday's successful backup guarantees recovery in fifteen minutes. The service desk calls a contact-list review a full interruption test, while the sole courier partner has not joined any exercise.
You must separate tolerable business harm from technical recovery claims. Orders can be recorded on controlled paper forms temporarily, but dispatch depends on accurate stock, warehouse staff, identity services, and the courier booking interface. The business needs an agreed recovery sequence and evidence that the whole service, not just a server, can resume.
A recovery objective is a business requirement; an observed recovery time is evidence about whether the chosen capability meets it.
Business impact analysis starts with services
A business impact analysis (BIA) identifies important activities, their owners, minimum acceptable service levels, dependencies, and how disruption consequences grow over time. Interview the people accountable for outcomes, not only system administrators. For dispatch, impacts include missed delivery commitments, lost revenue, safety-sensitive shipments, contractual penalties, and a growing order backlog. A risk assessment asks what could happen and how likely it is; the BIA asks what the interruption would mean over time, regardless of its cause.
Suppose disruption delays 40 orders per hour and each delayed order incurs an estimated 15 currency units of handling cost. Four hours creates 160 delayed orders and 2,400 in handling cost; eight hours creates 320 and 4,800 before penalties. At six hours, a dispatch cutoff adds a separate 10,000 contractual consequence. Impacts need not rise linearly. Record assumptions, seasonal peaks, and qualitative harms rather than hiding safety or legal consequences inside a single financial score.
The owner may approve a minimum service of 20 priority orders per hour during recovery, compared with 60 normally. That defines what usable recovery means and what backlog remains. An auditor asks for dated owner approval, impact thresholds, dependency maps, and reassessment after material changes. A spreadsheet ranking servers by purchase price is not a service-level BIA.
Three clocks: RTO, RPO, and MTD
Maximum tolerable downtime (MTD) is the disruption duration beyond which business impact becomes unacceptable. Recovery time objective (RTO) is the target elapsed time to restore a service to its agreed minimum level. Recovery point objective (RPO) is the maximum acceptable age of recovered data, expressed as a time interval before the disruption. RPO measures tolerable data loss, not how long restoration takes. Terminology varies across continuity standards, so document the scope and clock start explicitly.
Fenwick sets MTD at eight hours, RTO at four hours, and RPO at fifteen minutes, all measured for the order service with outage onset as the recovery clock start. An outage at 10:00 requires minimum service by 14:00; the unacceptable-impact boundary is 18:00. A usable recovery point at 09:50 loses ten minutes and meets RPO, while one at 09:30 loses thirty minutes and fails. Restoring by 13:00 cannot compensate for the older data. If service returns at 15:00, RTO is missed even though MTD has not yet been reached.
Set RTO below MTD to allow margin for validation, work recovery, and uncertainty. Here the four-hour gap must accommodate agreed backlog handling and stabilization before intolerable impact, not simply idle time. Verify whether failover, data checks, and user access fit within the four-hour target. An auditor expects approved objectives and timestamped test results for both elapsed recovery and recovered data age; a target written in a plan is not proof of capability.
Data age looks backward from the outage; service recovery and tolerable disruption look forward.
Backups are a recovery chain, not a success icon
A full backup copies all selected data. An incremental copies changes since the previous backup in its chain, while a differential copies changes since the last full backup. A Sunday full plus Monday through Wednesday incrementals needs the full and each required incremental to recover Wednesday's state. With a Wednesday differential, the Sunday full and Wednesday differential suffice. Incrementals usually reduce each backup's work but can lengthen or complicate restoration. Measure the actual restore chain against the RTO.
The 3-2-1 rule means three copies of data including the working copy, on two different media types, with one copy offsite. It reduces shared failure exposure but does not by itself stop ransomware or credential abuse. Protect an offline or immutable copy, separate administrative access, encrypt sensitive backups, preserve accessible recovery keys, and define retention and deletion. Three folders on the same disk are not three independent recovery copies; an offsite copy writable with the compromised production account may still be destroyed.
Nightly backups can lose nearly twenty-four hours of changes and cannot by themselves satisfy a fifteen-minute RPO. More frequent protected backups or log capture may close that gap, but replication can reproduce corruption and does not replace historical recovery copies. Test restoration into an isolated environment, validate record counts and application consistency, and record recovered timestamps. Auditors seek job logs, retention settings, access controls, key availability, and successful restore evidence, not just a green backup dashboard.
Continuity, disaster recovery, and crisis leadership
Disaster recovery (DR) restores technology and data after severe disruption. Business continuity (BC) keeps prioritized activities operating at acceptable levels, including people, facilities, communications, manual workarounds, and technology. A database failover is a DR action; using numbered forms and an alternate dispatch desk is a BC workaround. Neither proves that customers can actually receive goods. Define who activates each plan and the measurable conditions for returning to normal operations.
Crisis management provides senior coordination when uncertainty, reputational harm, or major cross-functional decisions exceed routine operations. A crisis team sets priorities, authorizes exceptional spending, coordinates legal and safety advice, and approves stakeholder messages. Technical responders still recover systems. Specify decision authority, deputies, an out-of-band contact method, escalation triggers, and a decision log. Avoid putting speculative causes or unsupported recovery promises in customer messages.
During Fenwick's outage, warehouse staff record priority orders on access-controlled numbered forms while DR staff restore stock and order data. Reconciliation must detect duplicates and missing entries before forms are retired. Crisis leaders decide when to notify customers and whether to shift delivery routes. Auditors ask for current roles, approved activation thresholds, communication records, and reconciled workaround transactions; a technical runbook alone does not establish business continuity.
Dependencies can set the real recovery limit
Map upstream and downstream dependencies for each prioritized activity: staff, premises, power, network, identity, encryption keys, applications, data, and external providers. Draw recovery order from those relationships. Restoring order servers is useless if operators cannot authenticate or retrieve keys. Include concentration risk: nominally separate suppliers may share a facility or subcontractor. Review whether alternate capacity is genuinely independent and available during a regional event.
Fenwick targets four-hour recovery, but its courier booking supplier promises only twelve-hour restoration. That mismatch cannot be solved by copying the supplier's contract into the plan. Agree a tested manual booking channel, qualify an alternate carrier with sufficient capacity, or obtain business approval to revise objectives and accept the residual impact. A service availability percentage is not a guarantee of a particular incident's recovery time or data recovery point.
Obtain supplier escalation contacts, relevant continuity commitments, recovery test scope and dates, and evidence of joint exercises where feasible. Assign an owner to each dependency gap and track actions to closure. Auditors compare supplier recovery capabilities with the business's objectives, not merely with the existence of a contract. Document assumptions and limitations when supplier evidence is unavailable; do not treat a questionnaire response as a witnessed recovery.
The slowest unmitigated dependency can defeat an otherwise fast technical recovery.
Exercise claims must match the evidence
A tabletop is a facilitated discussion of decisions under a scenario, without executing recovery. A walkthrough is a structured step-by-step review of a plan, roles, and resources to identify gaps. A simulation rehearses responses under realistic injected conditions, often in an isolated environment without stopping production. A full interruption exercise deliberately stops the live service and executes recovery or transfer of operations. Because names vary, record what actually ran, what stayed live, and what was excluded.
Use progressively demanding tests, with business approval, safety boundaries, rollback criteria, and communication plans. A tabletop can reveal that nobody owns supplier escalation but cannot demonstrate a four-hour technical restore. A simulation can measure restoration and data integrity for its tested scope; it cannot prove an untested production cutover. Full interruption offers stronger end-to-end evidence but carries real operational risk and is not automatically appropriate for every service or exercise cycle.
Retain an exercise plan, scope, participants, expected objectives, timestamped actions, recovered data age, integrity and business validation, and an after-action report. Record deviations, owners, deadlines, retests, and formal residual-risk decisions. An auditor samples a failed objective and follows it to remediation and retest. Attendance lists prove attendance, not recovered capability, and closing a finding without testing the fix leaves the central assurance question unanswered.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The wrong clock
Scenario sim+50 XP
Read the incident and answer both questions using abbreviations.
Incident brief
The order service fails at 10:00. Its approved targets are recovery by 14:00, no more than fifteen minutes of lost data, and intolerable business impact after eight hours. It returns at 13:00 using a 09:30 data copy. The manager says the 'four-hour RPO' was met and therefore all objectives passed.
Term bank, not all of these are right
RPOMTDRTOSLA
1.1Which objective did the thirty-minute data gap breach? (one abbreviation)
1.2Which measure defines the eight-hour unacceptable-impact boundary? (one abbreviation)
Task 2: The runbook called continuity
Scenario sim+50 XP
Identify the discipline demonstrated by each action.
Incident brief
Fenwick's director labels a database restoration script 'the entire continuity plan'. During an outage, warehouse staff keep taking priority orders on controlled numbered forms, with reconciliation assigned for later. Separately, engineers restore the database and fail over the application. The director calls the manual process a backup job.
Term bank, not all of these are right
business continuitydisaster recoverycrisis managementbackup strategy
2.1Which discipline does the temporary manual operating process demonstrate? (two words)
2.2Which discipline does restoring the database and application demonstrate? (two words)
Task 3: An impressive exercise label
Scenario sim+50 XP
Name the exercise actually performed in each case.
Incident brief
A manager reports a 'full interruption' because a facilitator described a power failure and asked leaders to discuss decisions; nobody executed recovery. In a separate exercise, engineers restore a test copy in an isolated environment while controllers inject supplier delays. Production stays live, but the team calls this second event a walkthrough.
Term bank, not all of these are right
tabletopsimulationwalkthroughfull interruption
3.1What is the discussion-only scenario exercise? (one word)
3.2What is the isolated practical rehearsal with realistic injected events? (one word)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
Evaluate six independent claims. The baseline requires a fifteen-minute RPO, a measured four-hour service RTO, supplier capability or tested fallback within that target, and exercise labels that match execution.
Reject each failing claim using its single closest reason code. Accept scoped claims backed by explicit evidence; do not assume one row repairs another.
Verdicts are accept or reject. Every rejection needs one reason code from: data-loss-gap | exercise-mislabel | supplier-gap | unmeasured-recovery.
Independent assurance claims
RE-1 | Recovery-point compliance is claimed using only nightly backups. The measured outage loses 9 hours of orders; the approved RPO is 15 minutes.
RE-2 | A full interruption test is claimed from a facilitated scenario discussion. No recovery actions ran and production remained live.
RE-3 | Four-hour end-to-end recovery is claimed although the required courier interface has 12-hour recovery and no tested alternate path exists.
RE-4 | Four-hour recovery capability is claimed solely from an approved plan and an attendance list. No elapsed recovery or business validation was recorded.
RE-5 | A scoped restore test records outage at 10:00, usable minimum order service validated at 13:00, and restored records through 09:50. The approved RTO is 4 hours and RPO 15 minutes; both measured objectives are claimed met for this test.
RE-6 | A supplier-fallback claim links an approved manual booking procedure to a joint timed rehearsal delivering minimum dispatch service in 3 hours, with capacity and reconciliation validated against the 4-hour target.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · GRC Fundamentals
People and Third Parties
Measure safer behavior, time workforce access changes, and manage supplier risk across the relationship lifecycle.
