[Governance, Risk, and Compliance (GRC)] A company recentlyexperienced aransomware attack. Although the company performssystems and data backupon a…

The core failure was the inability to restore data within the Recovery Point Objective (RPO), indicating that the disaster recovery (DR) plan was ineffective despite the existence of backups. The only way to verify that a recovery plan, including its technical components and processes, can meet its objectives (like RPO and RTO) is through regular testing. Performing regular DR tests would have exposed the flaws in the backup restoration process—whether due to data corruption, media failure, or procedural errors—allowing the company to correct them before a genuine incident occurred. This directly addresses the root cause of the recovery failure.

A. Encrypting and labeling tapes is a data security and media management control; it does not ensure the data on the tapes is valid or can be restored successfully.

B. Reverting to manual processes is a business continuity strategy to maintain operations when IT fails, not a corrective action to fix the failed IT recovery process.

D. A tabletop exercise is a discussion-based test that validates plans and roles (like a RACI matrix) but does not technically test the viability of backups or the restoration process.

1. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. Section 5

"Contingency Plan Testing

Training

and Exercises

" states

"Testing enables plan deficiencies to be identified and addressed... Testing should be conducted to determine the plan’s effectiveness and the organization’s readiness to execute the plan." This highlights that testing is the mechanism to find the exact type of failure described in the scenario.

2. Carnegie Mellon University

Software Engineering Institute

CERT® Resilience Management Model (CERT-RMM) v1.2. In the Service Continuity (SCON) process area

Specific Goal 4 (SG 4) is "Validate Service Continuity Plans." The associated Specific Practice (SP 4.1)

"Perform tests of the service continuity plans

" explicitly states that the purpose of testing is to "ensure that the organization can continue essential business operations and services in the event of a disruption" by validating the plan's effectiveness.

3. Wold

G. H. (1997). Effective Disaster Recovery Testing. Disaster Recovery Journal

10(2). This foundational article on the topic emphasizes that "The only way to be sure that the plan works is to test it." It details how testing uncovers unforeseen problems in recovery procedures

technology

and personnel readiness

which is precisely what the company in the scenario failed to do.