Continuity Audit Suite

The item is described as a continuity and disaster-recovery audit tool, so RTO and RPO should be core fields to verify. RTO is the target time to restore a service, while RPO is the maximum acceptable data-loss window; ask whether the suite records owners, evidence, and test results for each.

The description does not name a standard mapping, so ISO 22301 support should be confirmed rather than assumed. Ask whether it can link each requirement to policies, risks, corrective actions, and audit evidence, and whether that mapping can be exported.

The item is described as covering both business continuity and disaster recovery, but the scope should be checked by module. A useful implementation separates business processes and dependencies from technical items such as backups, failover, RTO and RPO tests, and restore logs.

Typical evidence includes a business impact analysis, recovery plan, backup report, exercise attendance record, incident log, and proof of a restore test. Because no vendor or file limits are supplied, ask whether it accepts PDFs, spreadsheets, screenshots, and signed approvals.