Scenario Business continuity and disaster recovery plans are required to counteract interruptions to business activities and to protect critical business processes from the effects of major failures or disasters. The Payroll Department (\"Department\") of ISO Company, Inc. is classied as a critical business process because of the sensitive, private, and confidential information it hosts. It would be disastrous for the Department if information gets lost or if its business systems go offline, even for a day. During planning meetings, IT auditors kept the following objectives in mind: Are the Department's business systems adequately backed up? Are backup copies of the Department's data held in a secure and remote media store? Is there evidence that the current backup strategy works in practice? Is there an appropriate disaster recovery plan established as part of the company's business continuity plan? Is the disaster recovery plan based on a thorough risk assessment