Help with a question

sumeetgandhi

With the objective of mitigating the risk and impact of a major business interruption, a disaster recovery plan should endeavor to reduce the length of recovery time necessary, as well as costs associated with recovery. Although DRP results in an increase of pre-and post-incident operational costs, the extra costs are more than offset by reduced recovery and business impact costs. True or false?

A. True
B. False

Can someone make this easy to understand with explanation?

kaiju

True!

Without a DRP the time to recover increases as does the costs because decisions and purchases will be made on a whim. Based on different scenarios, there will be plans to recover from a disaster in a methodical manner that will reduce the recovery time and costs. RPO and RTO are the two major factors that drive the DRP. The process of creating a DRP increases the pre-incident operational expenditure because of the actions that are required to create the plan. In many instances, an organization may incur additional cost to fund predefined after actions that were not paid in advance.   

My opinion: the pre-/post-incident costs should considered as being a part operational of costs to prevent an org from tanking. Simply because the likelihood of not having a DRP could be a death sentence. I hope that helps.

A small investment with big returns.

sumeetgandhi

Thank you Kaiju very much for putting this heavily worded question into a simple version. It helps a lot. 

kaiju

Glad I could help!

paul78

I would agree with @kaiju since I'm guessing that may be the question writer's intent but I figured I would just add my two cents. The question is worded in a way that that could imply that the right answer is False.

The question makes the comment "Although DRP results in an increase of pre-and post-incident operational costs, the extra costs are more than offset by reduced recovery and business impact costs."

In the real world, creating a DRP and to implement technologies where the cost to implement and maintain that DRP capability is higher than the business impact costs doesn't really make commercial sense. If the cost to have such a plan is higher than the cost of the business impact, for many businesses, it would make more economic sense to absorb the business impact costs from the business disruption. Normally, to figure out if a DRP investment makes sense, an organization needs to conduct a reasonably comprehensive business impact analysis or BIA before implementing a DRP.

kaiju

@paul78 > good additional information. I had actually had written more information that pertained to DRP being a part of BCP and their relationship to COOP. I also explained how the BIA for a DRP would help to identify and prioritize the assets and functions of an org. After proof-reading my comment several time I decided to remove that lengthy paragraph and just do the simplest description of DRP.

@sumeetgandhi > if needed, I am sure paul78, myself and other members can expand on this topic as far as you would like.

sumeetgandhi

@paul78 @kaiju - thanks again for the fantastic explanation. It makes a lot of sense now.