A company recently updated its disaster recovery plan (DRP) to ensure business continuity in the event of a disruptive incident. Which step will…

After a Disaster Recovery Plan (DRP) is created or updated, its effectiveness remains theoretical until it is validated. Developing and implementing a testing plan is the crucial next step. Testing, through methods like tabletop exercises, simulations, or full-scale drills, actively verifies that the plan's procedures, technical recovery solutions, and personnel are capable of meeting the defined recovery objectives (RTO/RPO). This process is essential for identifying flaws, gaps, and incorrect assumptions in the plan before a real disruptive event occurs, thereby ensuring its practical effectiveness.

B. Reviewing and updating the DRP regularly to ensure it remains relevant: This is a vital maintenance activity, but it does not actively validate the plan's workability. The plan has just been updated; testing is what ensures those updates are effective.

C. Performing a risk assessment of the company's information assets: A risk assessment is a foundational step performed before developing or updating a DRP to identify what needs protection, not a method to validate the completed plan.

D. Training employees on their roles and responsibilities during a disaster: While essential, training alone does not ensure the overall plan is effective. Testing validates the effectiveness of the training and the viability of the plan's technical and procedural components.

---

1. NIST Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems.

Section 5, "Contingency Plan Testing, Training, and Exercises," Page 39: "Testing and exercises are the most crucial elements of a viable contingency capability... Testing enables plan deficiencies to be identified and addressed, which serves to improve the capability of the organization to execute the plan when required." This directly supports that testing is the step to ensure effectiveness.

2. ISO/IEC 27031:2011, Information technology — Security techniques — Guidelines for information and communication technology readiness for business continuity.

Clause 8.1, "General": "The purpose of exercising and testing is to ensure that the ICT readiness for business continuity (IRBC) solution is effective, up-to-date, and fit for purpose and that it will meet the pre-determined business continuity requirements." This standard explicitly links testing to ensuring effectiveness.

3. Carnegie Mellon University, Software Engineering Institute, OCTAVE Allegro: Information Security Risk Assessment.

Phase 3, Step 8, "Develop a Risk Response Strategy," Page 41: This document outlines risk assessment as a precursor to developing mitigation plans (like a DRP). This confirms that risk assessment (Option C) is an input to the plan, not a validation of its effectiveness.