Greatest Risk in Cloud SaaS Data Backup and Retrieval?

CISA By islever Editorial Last updated

Short answer

C The vendor may be unable to restore critical data.

Question

An organization relies on an external vendor that uses a cloud-based Software as a Service (SaaS) model to back up its data. Which of the following is the GREATEST risk to the organization related to data backup and retrieval?
  1. The organization may be locked into an unfavorable contract with the vendor.
  2. The organization may not be allowed to inspect the vendor's data center.
  3. The vendor may be unable to restore critical data. Correct Answer
  4. The vendor may be unable to restore data by recovery time objective (RTO) requirements.

Key Takeaways

This question tests whether candidates prioritize actual data recoverability over performance metrics, revealing a common trap where RTO violations are mistaken for the primary backup failure.

Relying on external SaaS providers for data backups shifts critical operational control, making the inability to successfully restore data the most severe organizational threat. Community analysis confirms that functional recoverability outweighs contractual or timing concerns.

Common mistake: Candidates frequently select option D, assuming that failing to meet Recovery Time Objectives represents the ultimate business disruption, while overlooking that unrecoverable data renders any timeline irrelevant.

Expert Analysis

Why the Answer Is Correct

The primary purpose of any backup solution is to ensure data can be successfully retrieved during an incident. If a SaaS vendor cannot restore critical data, the backup mechanism has fundamentally failed, leading to permanent data loss and complete operational paralysis. ISACA prioritizes functional viability over secondary metrics, making data restoration capability the definitive greatest risk.

Why the Other Options Are Wrong

Option A addresses contractual flexibility rather than immediate data availability, which is a legal concern rather than an operational audit finding. Option B highlights a common access limitation in cloud models, but this is mitigated through independent SOC reports and SLAs rather than direct site inspections. Option D focuses on Recovery Time Objectives, which measure duration; however, if the data itself cannot be restored, the timeframe becomes meaningless.

Community Comment Notes

Multiple high-voted discussions emphasize that restoring data aligns with recoverability rather than RTO metrics, with one expert noting that timing issues fall under business continuity planning rather than core backup functionality [Comment 1]. Another contributor correctly points out that data restoration failures directly cause irreversible losses, whereas RTO breaches typically result in temporary downtime that can be managed with fallback procedures [Comment 2].

Official Reference

https://www.isaca.org/resources/isaca-journal/past-issues/2020/volume-5/cloud-computing-and-data-backup-risk-management

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between functional failures and performance failures when evaluating risk hierarchies. ISACA consistently ranks absolute operational capability over efficiency metrics in audit scenarios. Apply this principle to separate backup viability from recovery timelines.

Frequently Asked Questions

Why is option D incorrect for data backup risks?

RTO measures system uptime duration, not data recoverability. If backups fail completely, timing metrics become irrelevant to the organization's survival.

How do auditors assess SaaS backup reliability without site access?

Auditors rely on independent SOC 2 Type II reports, verified SLAs, and periodic restoration testing rather than physical data center inspections.

More CISA FAQ →

Community Votes

C
67%
D
33%

67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. 46080f2 👍 3 Answered C
    My experience is that if the area is always narrowed down in a question, the best answer options are those that relate to this narrowing down. Here we have the limitation to backup and retrieval in general. D. refers to business continuity / disaster recovery. If we now weigh up the greatest risk, "C. The vendor may be unable to restore critical data" is the right answer for me.
  2. blehbleh 👍 2 Answered C
    This is C. "An organization relies on an external vendor that uses a cloud-based Software as a Service (SaaS) model to back up its data. Which of the following is the GREATEST risk to the organization related to data backup and retrieval?" Answer D states restoring data. If you are restoring data that is an RPO not an RTO. one is a point in data and the other is a maximum amount of time a system can be down before a business experiences significant damage or unacceptable losses. So D, does not make sense, this is C.
  3. Sibsankar 👍 1
    C. The vendor may be unable to restore critical data. Reliability and effectiveness in data restoration are paramount when it comes to data backup services. If the vendor is unable to restore critical data when needed, it could result in significant operational disruptions, data loss, and potentially severe consequences for the organization. Therefore, ensuring that the vendor has the capability to restore critical data is of utmost importance in mitigating risks associated with data backup and retrieval.
  4. Swallows 👍 1 Answered C
    Dependence on an external vendor for data backup and retrieval means the organization's ability to access critical data hinges on the vendor's capabilities. If the vendor encounters difficulties or failures in restoring critical data, it can lead to significant disruptions, financial losses, and reputational damage to the organization.
  5. MJORGER 👍 1 Answered D
    D. The vendor may be unable to restore data by recovery time objective (RTO) requirements Recovery Time Objective (RTO) is a critical metric in disaster recovery and downtime tolerance.
Show 3 more comments
  1. PurpleParrot 👍 1 Answered D
    Not meeting RTO requirements encompasses the broader impact of both not being able to restore critical data and the timing of that restoration.
  2. Rachy 👍 1 Answered D
    D. Recovery time objective is essential for this scenario
  3. Zirgelis1 👍 1
    C. The vendor may be unable to restore critical data.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Greatest Fraud Risk: Mandatory Leave vs Access Reviews

S-grade

Environmental Detector Placement Risks in Data Centers

S-grade

Next Step When Periodic Access Reviews Are Missing | CISA

S-grade

Best Backup Scheme for Rapid Data Restoration?

S-grade

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide