What is the purpose of disaster recovery and business continuity testing, and how frequently is it typically conducted?

• A. Validate recovery capabilities and keep business operations running; typically conducted annually or semiannually (tabletop and live tests)
• B. Increase software licensing
• C. Replace physical offices with cloud
• D. Eliminate incident response plans

Answer: (A)

Disaster recovery and business continuity testing is about validating that recovery capabilities actually work and that critical business operations can continue after a disruption. It checks that the documented recovery procedures can meet the organization’s targets for how quickly services must be restored (RTO) and how much data loss is acceptable (RPO). These tests also train people, validate roles and communications, and reveal gaps in plans, dependencies, or resources so improvements can be made before a real incident occurs. Tests can be tabletop (discussion-based) or live (actual recovery drills), offering different levels of realism and risk.

Typically, these tests are conducted annually or semiannually to keep plans current as systems and processes evolve. More frequent testing may be appropriate for highly critical systems, but the standard cadence is a yearly or every-six-months cycle. The other options don’t fit because they describe actions unrelated to testing the organization’s ability to recover and maintain operations, such as increasing software licensing, moving offices to the cloud, or eliminating incident response plans.