In determining the acceptable time period for the resumption of critical business processes:

A.
only downtime costs need to be considered.

B.
recovery operations should be analyzed.

C.
both downtime costs and recovery costs need to be evaluated.

D.
indirect downtime costs should be ignored.

Explanation:

Both downtime costs and recovery costs need to be evaluated in determining the acceptable time
period before the resumption of critical business processes. The outcome of the business impact
analysis (BIA) should be a recovery strategy that represents the optimal balance. Downtime costs
cannot be looked at in isolation. The quicker information assets can be restored and business
processing resumed, the smaller the downtime costs. However, the expenditure needed to have the
redundant capability required to recover information resources might be prohibitive for
nonessential business processes. Recovery operations do not determine the acceptable time period
for the resumption of critical business processes, and indirect downtime costs should be considered
in addition to the direct cash outflows incurred due to business disruption. The indirect costs of a
serious disruption to normal business activity, e.g., loss of customer and supplier goodwill and loss of
market share, may actually be more significant than direct costs over time, thus reaching the point
where business viability is threatened.