In this simulation, you will learn how to align major capital expenditures (CapEx) with business risk requirements. Understanding which governance document drives technical budgeting is crucial for an executive security leader.

CCISO (712-50) Executive Decision Simulation

Executive Briefing

You are the CISO of a major cloud-hosted CRM platform. Following a severe regional weather event that nearly took your primary data center offline, the Board of Directors has mandated the construction of a secondary data center. You are sitting in a capital planning meeting with the CFO and the CIO. The CIO is requesting $15 million to build an identical, "Active-Active" mirrored facility. The CFO is pushing back, wanting to spend only $2 million on a bare-bones "Cold Site."

Business Context

Business Objectives: Maintain SLA commitments for enterprise clients while aggressively managing the company's operating margins.

Risk Appetite: The business cannot tolerate more than 4 hours of downtime for core database services, but can tolerate up to 48 hours for reporting and analytics modules.

Constraints: Capital expenditure (CapEx) is heavily scrutinized this quarter. Every dollar spent on IT infrastructure must be explicitly justified by pre-approved corporate governance documentation.

Decision Scenario

The CFO turns to you and asks: "We shouldn't be guessing at these budget numbers based on what IT *wants*, nor should we be arbitrarily cutting costs and risking the business. What official governance document gives us the exact requirements we need to build this budget accurately?"

Question

While designing a secondary data center for your company what document needs to be analyzed to determine to how much should be spent on building the data center?

Strategic Analysis

1. What is the real problem

The problem is an arbitrary tug-of-war over budget based on technical desire (the CIO) versus financial frugality (the CFO). Without a strategic framework, investments are either dangerously inadequate or wildly wasteful.

2. Business vs security perspective

Technical leaders often seek "Active-Active" perfection because it makes engineering easier and eliminates downtime. The business, however, evaluates risk mathematically. If an hour of downtime costs $100k, spending $10M to prevent 2 hours of downtime per year yields a negative ROI. Spending must strictly match the agreed-upon recovery needs.

3. Risk and impact analysis

To determine the budget, you must know the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) of the systems involved. A Hot Site (near-instant recovery) is vastly more expensive than a Warm Site or Cold Site. The document that governs these specific technical recovery tiers is what drives the capital expenditure.

4. Why the correct answer is BEST

The Disaster Recovery strategic plan (C) outlines the technical recovery strategies, prioritized system tiers, and the required RTO/RPO for IT infrastructure. It explicitly dictates whether you need to buy duplicate servers (Hot Site) or just an empty warehouse (Cold Site). Therefore, it directly answers "how much should be spent."

5. Why other options are weaker

A. Business continuity plan: The BCP is a broader business document focused on keeping operations running (e.g., relocating staff, manual processing workarounds). It does not explicitly define data center hardware budgets.
D. Enterprise Risk Assessment: The ERA identifies and quantifies risks across the organization. While it triggers the need for a DR plan, it does not detail the specific technical recovery strategies that dictate construction costs.
B. Application mapping document: This is a tactical IT inventory artifact used by engineers to understand dependencies, not an executive governance document used to justify multi-million dollar budgets.

Mini Lesson: DR Economics (RTO vs. Cost)

In executive security governance, cost and recovery time have an inverse exponential relationship. As Recovery Time Objective (RTO) approaches zero, the cost approaches infinity.
• Cold Site (Days): Low budget. HVAC, power, no hardware.
• Warm Site (Hours): Medium budget. Hardware present, data must be restored.
• Hot Site (Minutes/Seconds): High budget. Full mirroring, real-time replication.
The DR Strategic Plan (built off the Business Impact Analysis) tells you exactly which tier to buy.

EXECUTIVE TAKEAWAY: IT budgets should never be based on technical aspirations; they must be strictly tethered to the documented Disaster Recovery strategic plan.