I85PREP
⌘ K
EC-Council EDRP study materials
EC-Council EDRP study resources

EC-Council EDRP cheat sheet

EC-Council EDRP · Keep the key ideas within reach.

Quick reference

Business Continuity and Disaster Recovery

  • BIA output hierarchy: business function → criticality tier → RTO/RPO → dependent assets (people, process, technology, suppliers, facilities) → recovery strategy. RTO is set by the business owner, not by IT.

  • RTO (Recovery Time Objective) = maximum tolerable downtime before unacceptable impact; RPO (Recovery Point Objective) = maximum tolerable data loss measured backward from the failure instant. MTTR is measured from incident start to restored service; MTBF is mean time between failures.

  • Availability formula: A = MTBF / (MTBF + MTTR). A 99.9% target permits about 8.76 hours of downtime per year; 99.99% permits about 52.6 minutes; 99.999% permits about 5.26 minutes.

  • Recovery tier decision rule: RTO < 1 hour → active-active or hot site with automated failover; RTO 1–24 hours → warm site or pilot light; RTO > 24 hours → cold site, backup restore, or manual workaround.

  • Site types: hot site (near-zero RTO, highest cost), warm site (hours, partial equipment), cold site (days to weeks, space and power only), mobile site, reciprocal agreement, and cloud region failover.

  • DR test progression by assurance and risk: plan review/walkthrough → tabletop exercise → simulation → parallel test → full interruption test. Full interruption is the only test that proves real failover but carries production risk.

  • Backup rule 3-2-1: at least 3 copies of data, on 2 different media, with 1 copy offsite; modern extension adds 1 immutable or offline copy and 0 errors verified by restore testing. RAID is redundancy, not backup.

  • BCP/DRP lifecycle: scope and risk assessment → BIA → strategy selection → plan development → awareness and training → testing and exercises → maintenance and continual improvement (aligned to ISO 22301 Plan-Do-Check-Act).

  • Crisis management structure: incident commander, emergency operations center, damage assessment team, communications lead, and recovery teams; succession of authority and out-of-band contact lists must exist before the incident.