In determining the acceptable time period for the resumption of critical business processes:
A.
only downtime costs need to be considered.
B.
recovery operations should be analyzed.
C.
both downtime costs and recovery costs need to be evaluated.
D.
indirect downtime costs should be ignored.
Explanation:
Both downtime costs and recovery costs need to be evaluated in determining the acceptable time period before
the resumption of critical business processes. The outcome of the business impact analysis (BIA) should be a
recovery strategy that represents the optimal balance. Downtime costs cannot be looked at in isolation. The
quicker information assets can be restored and business processing resumed, the smaller the downtime costs.
However, the expenditure needed to have the redundant capability required to recover information resources
might be prohibitive for nonessential business processes. Recovery operations do not determine the acceptable
time period for the resumption of critical business processes, and indirect downtime costs should be considered
in addition to the direct cash outflows incurred due to business disruption. The indirect costs of a serious
disruption to normal business activity, e.g., loss of customer and supplier goodwill and loss of market share,
may actually be more significant than direct costs over time, thus reaching the point where business viability is
threatened.