The auditor ' s observation indicates that backup media is stored on-site in the data center, which is a major risk in disaster recovery and business continuity planning (BCP). Best practices recommend storing backup media off-site to prevent data loss due to fires, floods, cyberattacks, or other disasters affecting the primary site.
Off-Site Storage Reduces Disaster Risks:
Keeping backups only at the primary data center means that any physical disaster (fire, flood, theft, or power surge) can destroy both primary and backup data.
Best practices require off-site or cloud-based backup storage to ensure data recovery in case of emergencies.
Regulatory and Compliance Considerations:
IIA Standard 2110 (Governance): Emphasizes disaster recovery policies to protect critical IT assets.
ISO/IEC 27001 (Information Security Management System): Recommends storing backups in a geographically separate location.
NIST SP 800-34 (Contingency Planning Guide for Federal Information Systems): Requires off-site storage to ensure effective disaster recovery.
Why the Other Options Are Incorrect:
B. Backup procedures are adequate and appropriate according to best practices: ❌
Incorrect, as on-site-only storage violates best practices for disaster recovery.
C. Backup media is not properly indexed, as backup media should be indexed by system, not date: ❌
While indexing is important, the main issue here is improper storage, not indexing methods.
D. Backup schedule is not sufficient, as full backup should be conducted daily: ❌
Backup frequency depends on business needs; a weekly backup is common for many organizations.
However, the biggest concern here is lack of off-site storage, not frequency.
IIA GTAG (Global Technology Audit Guide) on Business Continuity and Disaster Recovery: Recommends off-site storage for backups.
ISO/IEC 27001 – Information Security Controls (A.12.3.1): Requires backup data to be securely stored off-site.
COBIT 5 Framework – DSS04 (Manage Continuity): Supports off-site backups for IT continuity.
Step-by-Step Justification:IIA References:Thus, the correct answer is A. Backup media is not properly stored, as the storage facility should be off-site. ✅