Recovery Options - MHA Consulting

Each critical business function or process has a level of impact on an organization and its dependency to the other functions.

Based on the data and recovery requirements of each function, there is a need for a viable recovery option based on a company’s Business Impact Analysis data.

There are three basic recovery options to consider:

As Needed: As needed options often take longer to implement after a business disruption and commonly cost more. However the overall cost can still end up lower than other recovery option prices.

Prearranged: The prearranged recovery option involves making arrangements in advance. An example of this can usually involve an agreement with a vendor to supply required systems, products, or services within an agreed upon timeframe after a business disruption.

Pre-established: Preestablished options are those that are purchased, configured, and administered before a disruption occurs. Each critical business function may use a different recovery option.

After a list of recovery requirements and options has been developed, the recovery time of each option can be determined.

Cost vs. Capability

After paring down a list of recovery options based on those that meet your companies Maximum Tolerable Downtime (MTD) and recovery requirements it is time to assess the cost and capabilities of each remaining option. In most cases, the higher the capability, the higher the cost. Data will be a critical factor in choosing a recovery option since all mitigation strategies will have to meet the company’s financial restraints. The following is a list of attributes necessary to consider when assessing recovery options.

• Cost – cost of the mitigation or recovery option
• Capability – capabilities of the option
• Effort – amount of effort it will take to implement and manage the option
• Quality – quality of the product, service, or data associated with the option
• Control – amount of control the company will retain over the critical business process
• Safety – in cases where physical safety is a concern, a safety rating of the solution should be considered
• Security – estimates of physical and virtual (information and network access) security the option provides
• Desirability – assessment of the overall desirability of an option. In many cases this is a qualitative judgment based on quantitative data

Finding the right balance between recovery capability and cost is the key to choosing the best recovery option for your company.