A BIA shows that adding a hot-standby environment for an internal reporting system would cost more each year than the annualized loss expectancy it would prevent. No law, regulation or contract requires the hot standby. Using cost-benefit analysis, what is the most appropriate decision?
Select an answer to reveal the explanation.
Short Explanation
You wouldn't pay a thousand dollars a year to insure a bike worth five hundred. When a control costs more than the loss it prevents, cost-benefit analysis says find a cheaper option or accept the risk. The trap is funding every control just because it lowers risk.
Full Explanation
Cost-benefit analysis compares the cost of a safeguard with the reduction in expected loss it delivers. When the annual cost of a control exceeds the annualized loss expectancy it would avoid, the return on that investment is negative, and spending on it destroys value unless a legal, regulatory or contractual obligation requires it. The scenario rules out such obligations, so the sound decision is to decline the hot standby or rescope it to a cheaper option, such as backup and restore or pilot light, that fits the system's recovery objectives, accepting the residual risk through the organization's normal risk acceptance process. Funding any control that reduces risk regardless of cost ignores the principle that controls should be proportionate to the value they protect. Transferring the remaining risk to the provider through the SLA misunderstands transfer; SLA credits are limited remedies and do not move accountability for the business impact. Building and testing the hot standby before deciding spends the money the analysis says should not be spent. Exam caveat: qualitative factors such as reputational harm can change the conclusion, so they should be recorded alongside the numbers. Operational check: document the CBA, the chosen alternative and the owner's signed risk acceptance in the risk register.