Are you studying for the CISA certification?
Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification.
Skillset can help you prepare! Sign up for your free Skillset account and take the first steps towards your certification.
In doing a Business Impact Analysis, the Senior Engineer met with all customer of the Data Center to determine their MTD, RTO, and RPO. One organization told him that they could not be down for more than 15 minutes. When he told them the cost of a hot fail over, and compared this to the cost to a warm fail (1 hour) and cold fail over (48 hours) they opted for a cold fail-over. The administrator did work with them to provide a 3 hour UPS. When the system did go down because of a 24-hour power outage due to a severe ice storm, the customer complained to management that their system was not up within 48 hours. How should the CISO respond to this?
Revisit the BIA with the customer and determine if their budget can afford at least a warm backup.
The customer is always right and should be given their money back.
Work with the Data Center Management to see if the budget or regulation allows for a Data Center electric generator.
Ensure that this BIA was worded exactly as the customer agreed to in the Security Plan, and the BIA agreement is included in the Plan.
The Data Center has a limited budget and the customer went in knowing that this was not considered a critical Data Center, but wanted to use them because of their low cost. The customer's budget is also very limited and sacrifices had to be made. Other than this, the Data Center's uptime SLA requirement is 95% but have been up 99% of the time over 5 years. They do an annual DR exercise, including getting their backup tapes from their offsite storage, and restoring data onto a test environment to ensure that all equipment works as advertised. They have a UPS for the data center sufficient to bring down servers gracefully. The customer had all this information.
Where to begin? ...They failed to meet to agreed upon 48hr RTO, why should the customer spend more money on a warm site when they did not get what was already agreed upon? The generator would have alleviated the power outage (a data center with UPS and no generator does not warrant the "U". Unless there is some reason to suspect the " wording of the BIA" I fail to see the relevance here...the service provider failed to meet their obligation and the selection pertaining to a refund seems justified.
Train with Skillset and pass your certification exam. Faster. Guaranteed.
Study thousands of practice questions that organized by skills and ranked by difficulty.
Create a tailored training plan based on the knowledge you already possess.
Know when you’re ready for the high-stakes exam. Have the confidence that you will pass on your first attempt.