The Recovery Objective That Outran the Budget
A 900-person payments processor has just finished its business impact analysis. The BIA shows that card authorization services must resume within 4 hours of disruption, with no more than 15 minutes of data loss. The current DR site is a warm standby that takes 26 hours to activate, and replication is nightly batch. The CIO has approved a strategy of 'active-active across two data centers' at a cost of $6.2M. The CFO has countered with a proposal to keep the warm standby, accept a 26-hour outage, and purchase $4M of cyber and business interruption insurance. The board has asked you, as BC lead, to advise. The organization is regulated and must file recovery capability statements with its primary regulator, which has recently begun asking for evidence of tested RTOs.
1. How should the BC lead frame the gap between the BIA-derived RTO and the two competing proposals?
Read the worked answer
The BIA has established the RTO as a business requirement, not a preference. The BC lead's job is to make the consequence of failing to meet it explicit and quantified, not to pick the cheaper option.
Steps:
- Restate the requirement. 4-hour RTO, 15-minute RPO for card authorization. These are derived from financial and regulatory impact analysis, not from IT preference.
- Model the gap. The warm standby delivers 26 hours - a 22-hour gap against the RTO. The active-active option closes it. Insurance does not close it; it transfers some financial loss but does not restore service.
- Quantify the exposure. Estimate revenue at risk per hour of outage, plus regulatory penalty exposure, plus customer attrition and contractual breach costs. Compare that to the $2.2M delta between the options.
- Test the insurance assumption. Business interruption policies typically have waiting periods, sublimits, and exclusions for unproven resilience. Insurance is a loss-financing tool, not a recovery capability.
- Present the regulator's lens. Filing a capability statement that claims 4-hour recovery while the actual capability is 26 hours is a misrepresentation risk. The regulator is asking for tested RTOs - an untested claim is itself a finding.
Recommendation framing: Present three options to the board - active-active, a middle tier (e.g., warm standby with continuous replication and partial hot capability, targeting 8–12 hours), and accept-and-disclose with regulator engagement. Each with cost, residual risk, and regulatory consequence. The BC lead advises; the board decides and owns the residual risk.
2. If the board chooses the warm standby, what must the BC lead do to keep the program defensible?
Read the worked answer
If the board accepts the gap, the BC lead must convert an undocumented exposure into a governed, documented, and monitored decision.
Required actions:
- Formal risk acceptance. Document the gap (22 hours against a 4-hour RTO), the rationale, the quantified exposure, and the accountable executive. Board minutes must record the acceptance.
- Regulator engagement. Do not file a capability statement claiming 4-hour recovery. Disclose the actual tested capability and the remediation plan with dates. Voluntary disclosure with a plan is treated very differently from a finding discovered in an exam.
- Manual workarounds and interim controls. Identify what the business can do during the 26 hours - manual authorization thresholds, alternate processing, extended credit limits for key merchants - and document them in the plan.
- Insurance alignment. Confirm the policy waiting period and sublimits actually match the 26-hour scenario; many BI policies have 12–24 hour waiting periods that erode the benefit.
- Roadmap to close. Define the staged investment path toward the RTO, with milestones and a review trigger (e.g., if transaction volume exceeds X, revisit).
- Exercise the real capability. Test the 26-hour recovery so the number is evidenced, not assumed. Report the tested result to the board.
Key principle: The BC lead does not own the risk decision, but does own making the decision visible, documented, and consistent with what is told to the regulator.