A 48-hour RTO against a 4-hour MTPD
Meridian Pay processes card authorizations for 1,800 online merchants. Its business impact analysis, completed in 2021, states that the maximum tolerable period of disruption for authorization services is four hours and that the minimum business continuity objective is 70% of normal transaction volume. The business continuity plan, however, commits to restoring service at the warm standby data centre within 48 hours. Operations staff explain that 48 hours is 'realistic' because the database is 14 TB and replication is asynchronous. Since the BIA was written, Meridian has moved its fraud-scoring engine to a single cloud region and added a new merchant segment that generates 35% of revenue. The next management review is in six months, and the BC manager proposes to wait until then to revisit the analysis.
1. Assess the fit between the BIA outputs and the plan. What nonconformities does this indicate?
Read the worked answer
The numbers do not fit. A 4-hour MTPD with a 48-hour RTO means the recovery strategy cannot deliver the service within the tolerable outage, leaving the organization in unacceptable impact for 44 hours. Clause 8.2 requires the BIA to set prioritized timeframes, and clause 8.3 requires strategies and solutions selected on those outputs and capable of meeting them. This is a nonconformity in both the analysis and the strategy, not a documentation slip.
The age of the BIA matters independently. Clause 8.2 requires updates at planned intervals and when significant changes occur. Moving fraud scoring to a single cloud region and adding a merchant segment worth 35% of revenue are significant changes: they alter both the impact of disruption and the risk profile, and the risk assessment should have examined concentration risk in that cloud region. The proposal to wait six months is also wrong in substance, because the trigger for review has already occurred. A credible response is an immediate BIA refresh, a risk assessment of the cloud dependency, and a decision either to reduce the RTO or to revalidate the MTPD with evidence.
2. The BC manager proposes changing the MTPD to 48 hours so that the plan becomes compliant. Evaluate this proposal.
Read the worked answer
An MTPD is an output of impact analysis, not a negotiation with the current architecture. It expresses the point at which the impact of not delivering becomes unacceptable, through contractual penalties, regulatory breach, customer loss or harm. Raising it to 48 hours because replication is asynchronous reverses the logic: the plan becomes the input and the business consequence becomes the variable. That is exactly the reasoning the standard is designed to prevent.
The original four hours is not automatically correct either. It was set in 2021 and may have been aspirational or based on assumptions the new merchant segment has changed. The defensible route is to redo the impact-over-time analysis with merchants, legal and finance: what actually happens at 4, 8, 24 and 48 hours? If the evidence supports a longer MTPD, document the rationale, assumptions and residual risk, and update the RTO and MBCO consistently. If it supports four hours, the strategy must change. Either way, top management should accept the residual risk and the decision should be recorded, because it affects contractual and regulatory exposure.
3. What should happen before the next management review, and how should it be recorded in the BCMS?
Read the worked answer
It should be handled as a corrective action under clause 10.2, not deferred as an agenda item. Containment comes first: a tested manual authorization fallback, pre-agreed merchant communications, and verification of the cloud region failover. Then refresh the BIA and risk assessment, present strategy options with cost and residual risk, update the plan and schedule an exercise that tests the chosen RTO.
Recording matters because the gap is evidence that the BCMS was not effective. The corrective action record should state the nonconformity, its cause, the action taken, the owner, the due date and how effectiveness will be verified. The refreshed BIA and risk results, the exercise results and the status of the action then become inputs to management review under 9.3.2, so that top management decides on resources and changes to the BCMS rather than being presented with a fait accompli.