Certified Information Security Manager (CISM)Incident ManagementMedium

A global manufacturing company relies heavily on its Enterprise Resource Planning (ERP) system for daily operations. A recent business impact analysis (BIA) determined that the maximum tolerable downtime (MTD) for the ERP system is 4 hours. Which of the following recovery strategies would BEST support meeting this MTD, assuming a significant system failure?

  1. AA warm site with daily incremental backups and manual restoration.
  2. BCloud-based archival of historical data with an on-demand recovery environment.
  3. CA hot site with real-time data replication and automated failover.
  4. DDaily full backups to tape, stored offsite with weekly retrieval.
Show answer & explanation

Correct answer: C. A hot site with real-time data replication and automated failover.

An MTD of 4 hours is extremely aggressive, indicating a need for near-instantaneous recovery. A hot site with real-time data replication and automated failover provides the fastest recovery time, typically measured in minutes or very low hours, making it the best option to meet such a strict MTD for a critical system.

Why the other options are wrong

  • A. A warm site requires significant setup and data loading, meaning RTOs would likely be 12-72 hours, exceeding the 4-hour MTD.
  • B. On-demand recovery environments still require provisioning and data loading, making a 4-hour MTD challenging, especially for a complex ERP system.
  • D. Tape backups with weekly retrieval would result in RTOs (Recovery Time Objectives) far exceeding 4 hours due to transport and restoration time.

Maximum Tolerable Downtime (MTD)

The absolute maximum period of time an organization can tolerate for a system or business function to be unavailable after a disaster or incident.

  • Determined by Business Impact Analysis (BIA).
  • Drives RTO and RPO requirements.
  • Critical for selecting appropriate recovery strategies.

Memory trick: Hot, Warm, Cold: Speed costs money. Cold is cheap, Hot is fast.

More Incident Management questions