Question

During a business impact analysis for an order-processing application, the business owner asserts that the application must be recovered within one hour. However, analysis shows that manual workarounds can sustain operations for up to eight hours before customer contractual penalties and irreversible reputational damage begin to accrue. Which value should the risk practitioner use to establish the maximum tolerable downtime (MTD) for this application?

Accepted Answer

Eight hours, because that is the point at which unacceptable business consequences begin

Answer

One hour, because the business owner's stated requirement takes precedence

Answer

Four hours, as a compromise between the stated requirement and the workaround capacity

Answer

Zero hours, because any downtime introduces measurable risk to the business