Test your strategic thinking and governance capabilities. This scenario simulates a real-world executive decision required of a Chief Information Security Officer balancing disaster recovery objectives against financial constraints.
Executive Briefing
You are the CISO of a large logistics corporation. Following a recent regional power grid failure, the Board of Directors has mandated a comprehensive review of the company's Business Continuity Planning (BCP) and Disaster Recovery (DR) strategies. The CFO is heavily involved, scrutinizing the rising costs of IT infrastructure.
Business Context
The Business Impact Analysis (BIA) has identified several tiers of critical systems. Tier 1 systems require near-immediate failover. However, a significant portion of the budget is being consumed by Tier 4 systems—historical data archives and non-critical administrative backends. These systems have a high tolerance for downtime (Maximum Tolerable Downtime of 30+ days). The CFO demands drastic cost reductions for protecting these low-priority assets.
Decision Scenario
You must propose a DR facility type for the Tier 4 systems to the BCP Steering Committee. To satisfy the CFO's cost-cutting directive, you need to select the most inexpensive option in terms of ongoing maintenance and hardware investment. In exchange for these cost savings, the business unit must formally accept that this strategy will result in the maximum possible recovery delay if a disaster occurs.
Question
Which of the following backup sites takes the longest recovery time?
AHot site
BCold site
CMobile backup site
DWarm site
Strategic Hint: Consider the inverse relationship between cost and speed. Which site type provides nothing more than a leased space with power and cooling, requiring you to procure, ship, and install all hardware post-disaster?
Strategic Analysis
1. What is the real problem
The core issue is balancing the financial burden of idle DR infrastructure against the Recovery Time Objective (RTO) required by the business. Over-provisioning DR for low-priority systems drains resources that could be used for revenue-generating activities or securing Tier 1 assets.
2. Business vs Security Perspective
Security and IT teams instinctively prefer Hot or Warm sites to minimize the operational headache of a disaster. However, the business (represented by the CFO) views DR as an insurance policy. Paying high premiums (Hot sites) for low-value assets (Tier 4 systems) is poor fiscal governance.
3. Risk and Impact Analysis
Selecting a Cold site minimizes capital and operational expenditures (CAPEX/OPEX). The residual risk is a massive delay in recovery—often weeks. This is a purely strategic, risk-acceptance decision. If the Business Impact Analysis (BIA) confirms the business can survive 30 days without the system, the cost savings of a Cold site are justified.
4. Why the Correct Answer is BEST (B)
Option B (Cold site) is correct. A cold site provides only the physical facility, environmental controls (HVAC), and connectivity. Because no computing hardware is pre-installed, equipment must be purchased, shipped, installed, and configured after the disaster strikes. This inherently results in the longest RTO.
5. Why Other Options are Weaker
A (Hot site): Fully redundant and mirrors the primary site in real-time. Highest cost, but shortest recovery time (minutes to hours).
D (Warm site): Contains pre-configured hardware and networks but lacks up-to-date data. Moderate cost, moderate recovery time (days).
C (Mobile site): Pre-configured trailers that can be driven to a location. Faster than a cold site because the hardware is already racked and ready.
6. Mini Lesson
Governance Principle: Cost vs. Readiness Trade-off. In DR planning, speed equals money. The shorter your Recovery Time Objective (RTO), the higher your ongoing maintenance cost. Executive leadership must strictly align DR site selection with the BIA. Assigning a Hot site to a non-critical business process is a failure of resource optimization, just as assigning a Cold site to a mission-critical process is a failure of risk management.
EXECUTIVE TAKEAWAY: "Align your disaster recovery investments directly with business impact; never pay for a hot-site recovery of a cold-site business process."