In determining the acceptable time period for the resumption of critical business processes:
only downtime costs need to be considered.
recovery operations should be analyzed.
both downtime costs and recovery costs need to be evaluated.
indirect downtime costs should be ignored.
Both downtime costs and recovery costs need to be evaluated in determining the acceptable time
period before the resumption of critical business processes. The outcome of the business impact
analysis (BIA) should be a recovery strategy that represents the optimal balance. Downtime costs
cannot be looked at in isolation. The quicker information assets can be restored and business
processing resumed, the smaller the downtime costs. However, the expenditure needed to have
the redundant capability required to recover information resources might be prohibitive for
nonessential business processes. Recovery operations do not determine the acceptable time
period for the resumption of critical business processes, and indirect downtime costs should be
considered in addition to the direct cash outflows incurred due to business disruption. The indirect
costs of a serious disruption to normal business activity, e.g., loss of customer and supplier goodwill
and loss of market share, may actually be more significant than direct costs over time, thus reaching
the point where business viability is threatened.