According to the CRISC Review Manual (Digital Version), reviewing the business impact analysis (BIA) will best help an organization select a recovery strategy for critical systems, as it provides an assessment of the potential impact and consequences of a disruption to the organization’s critical business functions and processes. Reviewing the BIA helps to:
Identify and prioritize the critical systems and their dependencies that support the critical business functions and processes
Estimate the maximum tolerable downtime (MTD) and the recovery time objective (RTO) for each critical system
Evaluate the feasibility and cost-effectiveness of various recovery strategies and options for each critical system
Select the most appropriate recovery strategy and option for each critical system based on the organization’s objectives and requirements
Develop and implement the recovery plan and procedures for each critical system
References = CRISC Review Manual (Digital Version), Chapter 3: IT Risk Response, Section 3.3: Risk Response Options, pp. 174-1751
