An application owner has specified the acceptable downtime in the event of an incident to...

According to the CRISC Review Manual (Digital Version), the next course of action when there is a gap between the acceptable downtime and the actual recovery time of an application is to prepare a cost-benefit analysis of alternatives available to reduce the gap. The cost-benefit analysis should compare the costs of implementing different risk response options, such as avoidance, mitigation, transfer or acceptance, with the benefits of reducing the impact and likelihood of the risk. The cost-benefit analysis should also consider the alignment of the risk response options with the enterprise’s risk appetite, business objectives and strategy. The cost-benefit analysis should help the application owner and the risk owner to select the most appropriate risk response option that optimizes the value of the application and minimizes the residual risk.

References = CRISC Review Manual (Digital Version), Chapter 3: IT Risk Response, Section 3.2: Risk Response Process, pp. 162-1631