Certified Information Security Manager (CISM)Incident ManagementHard
A CISO is developing a disaster recovery plan (DRP) for an organization that relies heavily on a critical legacy application. This application has highly specialized hardware requirements and is incompatible with modern virtualization platforms and cloud environments. The organization has a limited budget for DR, making a hot site financially unfeasible. Which of the following recovery strategies is MOST appropriate for this specific legacy application?
- AUtilizing a warm site with partially configured legacy hardware.
- BMigrating the application to a modern cloud-native architecture.
- CImplementing a cold site with specialized hardware pre-positioned.
- DNegotiating a reciprocal agreement with another organization for hardware.
Show answer & explanationAnswer & explanation
Correct answer: C. Implementing a cold site with specialized hardware pre-positioned.
Given the 'highly specialized hardware requirements', 'incompatible with modern platforms', and 'limited budget', a cold site with pre-positioned specialized hardware is the most appropriate and cost-effective strategy. While recovery time will be longer, it addresses the unique hardware needs within budget constraints.
Why the other options are wrong
- A. A warm site would still require significant investment for specialized hardware and configuration, which may exceed the 'limited budget' and may still have compatibility issues for partially configured legacy systems.
- B. Migrating to cloud-native is a long-term modernization project, not a DRP strategy for an incompatible legacy application with a limited budget.
- D. Reciprocal agreements are generally risky due to potential conflicts of interest, lack of dedicated resources, and the unlikelihood of finding another organization with identical specialized legacy hardware.
Cold Site
A disaster recovery site that has basic infrastructure (power, cooling, space) but lacks specific hardware, software, or data. It requires significant time and effort to become operational.
- Lowest cost DR option.
- Longest recovery time (RTO).
- Suitable for non-critical systems or unique hardware requirements with budget constraints.
Memory trick: For old, unique tech on a budget, a cold site is the bold choice.