An organization's disaster recovery plan (DRP) is documented and kept at a disaster recovery site. Which of the following is the BEST way to ensure…

The effectiveness of a disaster recovery plan (DRP) is fundamentally dependent on the ability of personnel to execute it correctly during a crisis. While the storage and accessibility of the plan are important, they are insufficient on their own. Annual training ensures that all relevant staff understand their specific roles, responsibilities, and the procedures they must follow. This regular reinforcement builds competence and confidence, transforming the DRP from a static document into an actionable, operational capability. Training and testing are the primary mechanisms for validating a plan and preparing the team for a real-world event.

A. Storing disaster recovery documentation in a public cloud addresses the plan's availability and accessibility but does not ensure staff are prepared to execute it.

B. Maintaining an outsourced contact center is a specific tactical component of a DRP, not a method for ensuring the entire plan's executability.

C. Requiring disaster recovery documentation be stored with all key decision makers ensures access for a limited group but fails to prepare the broader team responsible for implementation.

1. ISACA

CISM Review Manual

16th Edition. Domain 3: Information Security Program Development and Management. Section 3.5

"Business Continuity and Disaster Recovery." The manual emphasizes that plans must be regularly tested and personnel must be trained to ensure they can perform their roles effectively during a disruption. A plan is considered ineffective if the people responsible for its execution are not prepared.

2. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. Section 5.2

"Training

" states

"Training is a critical element for a viable contingency capability... to ensure that all personnel with contingency plan responsibilities are trained to execute the plan and are ready to respond to a system disruption." This highlights that training is essential for ensuring a plan can be carried out.

3. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements. Clause 7.2

"Competence

" and Clause 7.3

"Awareness

" require organizations to ensure that personnel are competent on the basis of appropriate education

training

or experience and are aware of their contribution to the effectiveness of the business continuity management system. This directly links training to the ability to carry out plans.