IIA CIA IIA-CIA-Part3 Question # 147 Topic 15 Discussion

The auditor's observation indicates that backup media is stored on-site in the data center, which is a major risk in disaster recovery and business continuity planning (BCP). Best practices recommend storing backup media off-site to prevent data loss due to fires, floods, cyberattacks, or other disasters affecting the primary site.

Off-Site Storage Reduces Disaster Risks:

Keeping backups only at the primary data center means that any physical disaster (fire, flood, theft, or power surge) can destroy both primary and backup data.

Best practices require off-site or cloud-based backup storage to ensure data recovery in case of emergencies.

Regulatory and Compliance Considerations:

IIA Standard 2110 (Governance): Emphasizes disaster recovery policies to protect critical IT assets.

ISO/IEC 27001 (Information Security Management System): Recommends storing backups in a geographically separate location.

NIST SP 800-34 (Contingency Planning Guide for Federal Information Systems): Requires off-site storage to ensure effective disaster recovery.

Why the Other Options Are Incorrect:

B. Backup procedures are adequate and appropriate according to best practices: ❌

Incorrect, as on-site-only storage violates best practices for disaster recovery.

C. Backup media is not properly indexed, as backup media should be indexed by system, not date: ❌

While indexing is important, the main issue here is improper storage, not indexing methods.

D. Backup schedule is not sufficient, as full backup should be conducted daily: ❌

Backup frequency depends on business needs; a weekly backup is common for many organizations.

However, the biggest concern here is lack of off-site storage, not frequency.

IIA GTAG (Global Technology Audit Guide) on Business Continuity and Disaster Recovery: Recommends off-site storage for backups.

ISO/IEC 27001 – Information Security Controls (A.12.3.1): Requires backup data to be securely stored off-site.

COBIT 5 Framework – DSS04 (Manage Continuity): Supports off-site backups for IT continuity.

Step-by-Step Justification:IIA References:Thus, the correct answer is A. Backup media is not properly stored, as the storage facility should be off-site. ✅