CISA Practice Test 9

Disaster recovery test — electronic health record system

A regional hospital's electronic health record (EHR) system runs in its primary data center. Transaction logs are shipped every 15 minutes to a contracted hot site, and full backups are taken nightly and copied to the same site. The BIA, approved by clinical leadership, sets an RTO of 4 hours and an RPO of 1 hour for the EHR.

During the annual disaster recovery test, IT staff found that log shipping had stopped three weeks earlier, so the EHR was restored from the previous night's full backup. The test was planned and run by the IT infrastructure team alone. The test report, signed by the IT infrastructure manager, rated the test "successful" because the EHR was online within the RTO.