IT Business & Disaster Recovery Planning (CY-604 (A)) - Important Questions

Explain the various laws and acts relevant to Disaster Recovery (DR) planning, including Data Protection legislation and CAN-SPAM. Discuss how these laws influence the design and execution of DR strategies and the obligations they impose on organizations.

Discuss the regulatory compliance requirements of GDPR, HIPAA, SOX, and PCI DSS as they relate to backup, retention, recovery time objectives (RTO), and recovery point objectives (RPO). Explain practical measures to ensure compliance in DR plans.

Describe the procedures for preserving chain of custody, conducting e-discovery, and implementing legal holds during incident response and disaster recovery. Explain why these procedures are critical for compliance and litigation readiness.

Compare and contrast ISO 22301 and NIST guidance relevant to Business Continuity and Disaster Recovery (for example, NIST SP 800-34 or NIST SP 800-61). Highlight key requirements, control objectives, and how organizations map these standards into their DR programmes.

Explain the contractual and commercial considerations in DR planning, including Service Level Agreements (SLAs), vendor liability clauses, insurance coverage for business interruption, and third-party risk management. Illustrate with examples how these affect recovery decisions.

Design a compliance checklist for disaster recovery testing and audits. List the types of evidence and documentation regulators or auditors typically require, and describe how to maintain this evidence to demonstrate compliance over time.

Discuss the legal penalties and consequences of non-compliance with data protection and breach notification laws following a security incident. Provide examples of regulatory fines and civil liabilities that may result from inadequate DR and incident response.

Explain the issues surrounding cross-border data transfers and data residency in the context of disaster recovery solutions (including cloud backups and offsite replication). Describe compliance strategies to address differing national data protection requirements.

Prepare a detailed incident notification and reporting procedure for a DR plan that meets common statutory and contractual requirements. Include timelines, stakeholder roles (internal and external), content of notifications, and escalation criteria.