A bank's newly drafted disaster recovery plan documents detailed restoration procedures for its core banking platform. During a review, the information security manager wants to confirm the plan reflects the recovery objectives the business actually agreed, rather than what is technically convenient. Which input should the recovery procedures in the disaster recovery plan be designed to satisfy?
- AThe vendor's published maximum supported restore throughput for the backup appliance, since the technology's stated capability sets the realistic ceiling for any recovery procedure.
- BThe recovery time and recovery point objectives agreed for the platform, since these define the maximum tolerable outage and data loss the recovery procedures must be built to achieve. Correct
- CThe mean time between failures reported for the platform's hardware, since a lower failure rate justifies lighter recovery procedures and reduces the cost of maintaining the plan.
- DThe preferences expressed by responders during the most recent tabletop exercise, since the people who execute the procedures are best placed to decide the recovery targets they can meet.
Why A is wrong: Tempting because tooling does constrain what is achievable, but designing the plan around vendor throughput puts the technology's convenience ahead of the business need; if the capability cannot meet the objective, that is a gap to close, not the target.
Why B is correct: Correct. RTO and RPO express the business-agreed limits on outage duration and data loss, so the DRP's restoration procedures must be designed to meet these objectives rather than whatever the current tooling happens to deliver.
Why C is wrong: Tempting because reliability data informs risk, but MTBF describes how often failure occurs, not how quickly recovery must happen; it cannot tell the manager what outage or data loss the business will tolerate.
Why D is wrong: Tempting because responder feedback improves procedures, but letting executors set the recovery targets risks defining objectives around what is comfortable to deliver rather than what the business can tolerate losing.