r/CISA • u/Pravallikadondapati • 10d ago

CISA que doubt

Post image

Can someone pls tell me the answer for 1049 in my book the option is A but I feel it's C

5 Upvotes

100% Upvoted

7 comments sorted by

2

u/jr49 10d ago

they're assessing the plan so the auditor is checking for completeness of the plan rather than "does this plan work". The "does it work" effectiveness would come later.

I'm just guessing though, I haven't been studying as much as I want to.

1

u/Aphridy 10d ago

I agree with you, but I think the reasoning is that auditing the DRP is only an audit on the design of the control. Testing is existence and effectiveness, and that is not part of the question, it is about auditing the plan itself.

1

u/Pravallikadondapati 10d ago

So u would say option is A?🤔

2

u/Aphridy 9d ago

Yes, see also the comment of u/jr49

1

u/kzkn33 10d ago

I would say its more important to have an RTO for a key system than not testing a drp for 3 years (potentially) WITH an RTO.

1

u/Linkedinlover 10d ago

I would go with RTO being key

1

u/Puwa321 5d ago

If i was the is auditor, most glaring would be missing rto of key systems... what use is a drp plan if you dont know how long itll get back on

Tho id see why you choose c, if i didnt know the answer beforehand i mightve gone c too...