Study. uk . com
  1. Home
  2. All questions
  3. Question 138

CISSP study material · question 138 of 500

Two divisions of the same firm choose different recovery solutions for systems with similar impact levels, and an auditor asks which one is wrong. What does NIST SP 800-34 say about the choice?

  1. The more expensive solution is always correct where the impact levels match.
  2. The choice must follow whichever solution the parent organisation selected.
  3. The choice is fixed by the availability impact level and cannot differ.
  4. Each organisation and system has its own balance point between the cost of disruption and the cost of recovery.
Show the answer

Answer: D. Each organisation and system has its own balance point between the cost of disruption and the cost of recovery.

A shorter recovery time objective costs more to implement, and the point at which disruption cost meets recovery cost differs for every organisation and system.

Source: NIST SP 800-34 Rev. 1 (NIST) — SP 800-34 Rev. 1 > 3.2.1 Cost Balancing

Challenge yourself on this topic → Study as cards