A BIA shows that a hospital's medication dispensing process tolerates only a short outage. If its system fails there is no documented way to continue, and a redundant system has been rejected as too costly. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
When the screen goes dark, the medicine still has to get to patients. Documented manual workarounds, paper forms and checklists your staff have practiced, keep the process alive while IT fixes the system. Lowering the criticality because the system usually works is the trap; past uptime doesn't change what an outage would cost.
Full Explanation
Manual workarounds are a recognized continuity strategy for critical processes where technical redundancy is not justified. Developed with the process owner, they define how the process continues without the system, what records are kept so data can be entered once the system returns, who authorizes their use and how staff are trained. For a process with a short tolerance and no affordable redundant system, they are the practical way to keep impact within tolerance. Lowering the criticality because the system has been reliable confuses likelihood with impact; the BIA rates the consequence of disruption, and the consequence here is unchanged. Shortening the recovery time objective sets a tighter target without providing any capability to meet it, and no restoration is instant, so the process would still stop during recovery. Closer security monitoring may help detect some causes of failure but does nothing to keep the process running once the system is unavailable, whatever the cause. Exam caveat: workarounds must be exercised regularly and include the procedure for reconciling manual records afterward. Operational check: confirm the workaround forms are available at each dispensing point, staff have practiced them within the defined period, and the reconciliation procedure has been tested.