Leadership wants to buy a hot site immediately and skip the BIA to 'save time.' What sequencing should the risk manager recommend?
Select an answer to reveal the explanation.
Short Explanation
Buying a spare mansion before you know which rooms you live in is expensive guesswork. The BIA tells you what must come back first and how fast. Let impact analysis steer the hot-site spend, not the other way around.
Full Explanation
Business impact analysis identifies which functions, dependencies, and timeframes justify disaster recovery investment. Completing BIA work before buying a hot site so investments match actual critical function needs is the correct sequencing for a civic organization pressed to “save time.” Without that grounding, leadership may overbuy unused capacity, underprotect true priorities, or lock into contracts that do not serve citizen-facing recovery order.
Purchasing the largest hot site first, then inventing criticality rankings to match the contract, reverses analysis and turns the BIA into marketing justification. Skipping impact analysis forever because site brochures replace business priorities confuses vendor capability claims with organizational need. Funding only tabletop exercises and never acquiring alternate facilities of any kind can be equally misaligned when BIA evidence shows facility recovery is required—exercises inform; they do not substitute for justified capacity.
Exam caveat: BIA before major DR spend is a recurring CRMC sequencing theme. Speed of procurement is not a substitute for impact evidence.
Operational check: finish (or refresh) the municipal BIA for in-scope functions; derive recovery tiers and time objectives; only then size hot/warm/cold options against those needs; record why the chosen site type matches BIA priorities in the investment brief.