Comprehensive and Detailed Explanation:
* Understanding the Ransomware Issue:
* The key issue here is that backups were not recoverable within the required RPO timeframe.
* This means the organization did not properly test its backup and disaster recovery (DR) processes.
* To prevent this from happening again, regular disaster recovery testing is essential.
* Why Option C is Correct:
* Disaster recovery testing ensures that backups are functional and can meet business continuity needs.
* Frequent DR testing allows organizations to identify and fix gaps in recovery strategies.
* Regular testing ensures that recovery meets the RPO & RTO (Recovery Time Objective) requirements.
* Why Other Options Are Incorrect:
* A (Encrypt & label backup tapes): While encryption is important, it does not address the failure to meet RPO requirements.
* B (Reverting to manual business processes): While a manual continuity plan is good for resilience, it does not resolve the backup and recovery failure.
* D (Tabletop exercise & RACI matrix): A tabletop exercise is a planning activity, but it does not involve actual recovery testing.