The best key performance indicator (KPI) to measure the effectiveness of a disaster recovery test of critical business processes is the percentage of processes recovered within the recovery time and point objectives.
Recovery time objective (RTO) is the maximum acceptable time period within which a business process or an IT service must be restored after a disruption. Recovery point objective (RPO) is the maximum acceptable amount of data loss measured in time before the disruption. The percentage of processes recovered within the RTO and RPO indicates how well the disaster recovery test meets the business continuity and recoveryrequirements and expectations, and how effectively the disaster recovery plan and procedures are executed. The percentage of processes recovered within the RTO and RPO canalso help to identify the gaps, weaknesses, and opportunities for improvement in the disaster recovery capabilities. Percentage of job failures identified and resolved during the recovery process, number of current test plans and procedures, and number of issues and action items resolved during the recovery test are not as good as the percentage of processes recovered within the RTO and RPO, as they do not directly measure the achievement of the recovery objectives, and may not reflect the actual impact and performance of the disaster recovery test. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 130.