CISSP BCP and Disaster Recovery: BIA, MTD, RTO and RPO, Recovery Sites and the Five DR Test Types

Business continuity and disaster recovery appear in two places in the CISSP outline. Objective 1.7 in Domain 1 asks you to identify, analyze, assess, prioritize and implement business continuity requirements, and lists the business impact analysis (BIA) and external dependencies. Objectives 7.10 to 7.13 in Domain 7 cover recovery strategies, disaster recovery processes, DR plan testing and business continuity exercises. This guide follows both 2024 and 2027 outlines, which keep the same numbering, and uses NIST SP 800-34 Rev. 1 for the definitions ISC2's outline doesn't spell out.

BCP vs DRP on the CISSP

NIST SP 800-34 Rev. 1 draws the basic distinction:

A useful rule for scenario items, as Passy's reading: if the question is about which business functions continue and in what order, it's BCP territory; if it's about bringing systems back at another site, it's DR. The BIA feeds both. NIST says BIA results should be incorporated into an organization's continuity of operations plans, BCPs and DRPs.

The BIA: where every CISSP recovery number comes from

NIST describes the BIA as correlating a system with the critical business processes and services it supports, then characterizing the consequences of a disruption. In practice, the planner works with process owners, leadership and business managers to decide how much downtime and data loss each process can tolerate.

That last point matters for scenario items: recovery targets are business decisions. The security or IT team gathers the data and proposes options, but the process owners and senior management set the tolerances. A question asking who should determine the MTD for payroll points to the business, not the IT department.

NIST's seven-step contingency planning process shows where the BIA sits: develop the contingency planning policy, conduct the BIA, identify preventive controls, create contingency strategies, develop the plan, ensure testing, training and exercises, and ensure plan maintenance.

MTD, RTO and RPO without mixing them up

Two rules from NIST settle most questions:

1. The RTO must normally be shorter than the MTD. Once a system is back, the business still needs time to reprocess work. NIST says that additional processing time must be added to the RTO to stay within the MTD. Many CISSP study materials call that catch-up period the work recovery time (WRT), so RTO + WRT stays within the MTD.
2. The RPO isn't part of the MTD. It's about how much data the process can afford to lose, not how long it can be down.

A worked example (original). A BIA finds that online order fulfillment can be down for at most 24 hours, that staff need about 6 hours after systems return to re-enter and verify the backlog, and that the business can lose no more than 1 hour of orders.

• MTD = 24 hours
• RTO ≤ 24 − 6 = 18 hours
• RPO = 1 hour, so backups or replication must capture order data at least hourly

Nightly backups would fail that RPO by up to 23 hours, however fast the restore.

These terms are recall-heavy, and 580 flashcards in the CISSP prep planned for launch suit terms like MTD, RTO and RPO.

Choosing a recovery site for a CISSP scenario

The 2024 outline lists recovery site strategies "cold vs. hot" plus resource capacity agreements and multiple processing sites; the 2027 outline adds warm sites to that example. NIST describes the site types:

NIST adds two points worth knowing: a fixed alternate site should be in an area unlikely to be hit by the same hazard as the primary site, and organizations can also back each other up through reciprocal agreements.

The decision rule follows from the RTO (Passy's reading): a short RTO rules out a cold site, and a near-zero RTO for a critical process points to a hot or mirrored site. If the cost of the faster site exceeds the loss it prevents, that's a business decision, which is where the CISSP risk calculations guide comes in.

Backups and resilience in Domain 7

Objective 7.10 also lists backup storage strategies (cloud, onsite and offsite, with immutable and encrypted backups added in the 2027 outline) and system resilience, high availability, quality of service and fault tolerance. In exam terms, backups serve the RPO, and resilience features such as redundant systems reduce the chance that you need the DR plan at all.

Objective 6.3 in Domain 6 connects the two worlds: security process data to collect includes DR and BC information, along with backup verification data. A backup that has never been restored in a test is a guess, not a recovery capability.

The DR process steps in objective 7.11

Both outlines list the same elements for implementing disaster recovery processes: response, personnel, communications, assessment, restoration, training and awareness, and lessons learned. In this part of Domain 7, the 2027 outline adds two examples:

• Communications gains "prioritization," alongside methods.
• Metrics appears as a new entry, with a baseline, mean time to resolve (MTTR) and mean time between failures (MTBF).

Note ISC2's wording: the 2027 outline expands MTTR as mean time to resolve, so learn it that way even if you've seen "mean time to repair" elsewhere.

Security Operations holds most of these objectives, and 188 of the 1,450 questions planned for full CISSP prep cover Security Operations.

The five DR test types in the CISSP outline

Objective 7.12 lists five ways to test a DR plan: read-through/tabletop, walkthrough, simulation, parallel and full interruption. ISC2's outline names them without defining them. The descriptions below are the meanings commonly used in CISSP study materials, aligned with NIST where NIST describes a similar exercise.

Two exam-style rules (Passy's reading): tests usually progress from discussion to full interruption as the plan matures, and a full interruption test, above all, needs senior management's explicit approval because it can itself cause an outage.

BCP and DR practice items written by Passy

These are original items, not ISC2 questions.

1. A pharmacy system's MTD is 8 hours. After the system is restored, staff need about 2 hours to verify and catch up on prescriptions. Which RTO is consistent with the BIA: 10, 8, 6 or 12 hours?

Keyed answer: 6 hours. The RTO plus the catch-up time must fit inside the MTD: 6 + 2 = 8. An 8-hour RTO leaves no time for verification, and 10 or 12 hours exceed the MTD on their own.

2. A DR plan has just been written. The coordinator sends a copy to each team lead and asks them to review it on their own and confirm that their steps and contact details are complete and current. No meeting is held and no system is touched. Which of the five test types is this?

Keyed answer: a read-through. Reviewing the plan document individually checks its content without touching any system. A walkthrough brings the team together to talk through the plan, a simulation plays out a scenario, and parallel and full interruption tests involve real systems.

3. A finance team says it can lose no more than 15 minutes of transactions. The current backup runs every night. Which target is missed, and what changes?

Keyed answer: the RPO. Nightly backups mean up to about a day of lost data. Meeting a 15-minute RPO requires much more frequent backups or continuous replication, whatever the RTO.

Studying CISSP BCP and DR this week

Draw the timeline once: disruption, RTO, catch-up time, MTD, with the RPO pointing backward to the last good backup. Then work every BC/DR question you find against that drawing. Incident response, which often comes before a recovery decision, is covered in the CISSP incident management guide, and the 20 free CISSP practice questions include a BIA item on recovery targets and a DR testing item. If your test date is on or after April 15, 2027, the CISSP 2027 outline guide lists the other Domain 7 additions, and you can see which planned CISSP access period covers your study window while checkout is still closed.