IT has already purchased a recovery site contract and selected backup technologies, but no business impact analysis has been performed. What is the PRIMARY concern for the information security manager?
Select an answer to reveal the explanation.
Short Explanation
Buying a recovery site before doing the BIA is like buying shoes before you know who's going to wear them. They might fit, or they might be three sizes off. The real worry is a mismatch with what the business actually needs; cost comparisons and vendor support come second.
Full Explanation
Recovery strategies are selected to meet the recovery requirements that a business impact analysis establishes, such as which processes are critical, their recovery time and recovery point objectives and their dependencies. Choosing a site and backup technology first means the organization cannot know whether critical processes will be recovered fast enough, whether data loss will stay within tolerance or whether spending has been directed at the wrong systems. The result may be under-protection of what matters most, over-spending on what matters least, or both. Whether a cloud alternative would have been cheaper is a valid cost question, but cost can only be judged against requirements that have not yet been defined. Vendor support lifetime is a technology management concern that does not address whether the solution meets business needs. Approval by internal audit is not a step in strategy selection; audit provides independent assurance and does not approve management's continuity decisions. Exam caveat: existing investments need not be discarded; the BIA may confirm they are adequate, or show where they must be adjusted. Operational check: perform the BIA, then map each critical process's recovery objectives to the purchased capabilities and record any gaps for management decision.