Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Meridian Pharma's finance system supports month-end reporting. A business impact analysis concludes the system can be unavailable for at most 4 hours and that no more than 30 minutes of transactions may be lost. Which pair of recovery objectives does this set?

The recovery time objective is 4 hours, being the longest acceptable outage, and the recovery point objective is 30 minutes, being the most data loss tolerated. The RPO then drives how frequently data must be backed up or replicated.

  1. ARecovery time objective of 30 minutes and recovery point objective of 4 hours
  2. BRecovery time objective of 4 hours and recovery point objective of 30 minutesCorrect
  3. CBoth objectives are 4 hours, since downtime and data loss are the same measure
  4. DRecovery time objective of 4 hours and maximum tolerable cost of 30 minutes

Explanation

The recovery time objective is the maximum acceptable downtime, here 4 hours. The recovery point objective is the maximum acceptable data loss measured in time, here 30 minutes. Option A reverses them, and the other options confuse distinct measures.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions