City council demands 'full continuity' for a rarely used intranet wiki equal to water SCADA HMI remote access. What should the security leader do?
Select an answer to reveal the explanation.
Short Explanation
Equal love for every app is politics, not continuity. Water HMI access can threaten public health; a dusty wiki mostly threatens convenience. Without BIA evidence of similar impact, 'full continuity for everything' is a budget and focus trap.
Full Explanation
Continuity requirements must follow demonstrated time-sensitive impact, not political demands for equal 'full continuity' across every application. Remote access to water SCADA human-machine interfaces can affect drinking water and public health; a rarely used intranet wiki primarily affects convenience and internal collaboration. Absent BIA evidence that the wiki's downtime produces comparable mission or safety consequences, assigning identical RTOs dilutes budget, staffing, and attention away from industrial control access that actually warrants aggressive recovery. Approving equal objectives solely to avoid council conflict substitutes politics for risk analysis and can create a false sense that both systems are equally protected. Lowering SCADA continuity to match the wiki, or reclassifying the wiki as SCADA infrastructure, either increases real public-safety risk or corrupts asset taxonomy for procurement theater. Exam caveat: CISSP expects leaders to defend differentiated recovery objectives with BIA data and to resist treating all systems as equally critical. Operational check: present impact curves, MTD/RTO differences, and cost of parity to council; document accepted residual risk for lower-tier systems; and keep SCADA remote access in the highest continuity tier with tested failover, monitoring, and access controls. Refresh the comparison when wiki usage or SCADA architecture changes so priority remains evidence-based.