The information security manager is helping select a continuity strategy for a payment-clearing process. Several options with very different costs are available. What should PRIMARILY drive the selection?
Select an answer to reveal the explanation.
Short Explanation
Your BIA already told you how fast this process has to come back and how much loss it can take. That's the yardstick every option gets measured against. Picking the cheapest or copying the neighbors is the trap; neither one knows what your payment process can tolerate.
Full Explanation
Continuity strategies exist to meet business requirements, and those requirements are established in the BIA as recovery time and recovery point objectives, maximum tolerable downtime and the impact profile over time. The selection should identify the options that meet those objectives and then choose among them on cost and practicality, so that spending is proportionate to the impact being avoided. Following peer organizations may provide useful ideas, but peers have different processes, tolerances and risk appetites, so their choices do not establish what this process needs. Choosing the cheapest option ignores whether it meets the recovery objectives; an inexpensive strategy that restores clearing too late is a waste of money, not a saving. Choosing what IT knows best optimizes for implementation convenience rather than business need and may produce a solution that is easy to deploy but unable to meet the objectives. Exam caveat: cost still matters; the BIA sets the minimum requirement, and the business case selects the most cost-effective option that satisfies it. Operational check: tabulate each option's achievable recovery time and data loss against the BIA objectives, eliminate those that fail, and present the remainder with costs for management decision.