During a tabletop exercise, a hospital group finds that responders disagreed about which systems to restore first, so non-urgent applications competed with life-critical clinical systems for the same recovery resources. The architect must add the planning artefact that resolves this before a real ransomware event. Which design practice best addresses the problem?
- AShorten the recovery time objective for every application equally so that all systems are guaranteed to be restored within the same short window after an incident.
- BIncrease backup frequency for every system so that more recent restore points are available and the recovery point objective improves uniformly across the estate.
- CReplicate all clinical and non-clinical workloads to a standby region so that any disagreement can be sidestepped by failing the entire estate over at once.
- DDefine and agree a tiered list of business-critical services with a fixed recovery priority order so responders restore the most essential systems first during an incident. Correct
Why A is wrong: Tightening every recovery time objective sounds ambitious and resilience-minded, but treating all systems as equally urgent ignores capacity limits and recreates the very contention observed, so it does not resolve the prioritisation problem.
Why B is wrong: More frequent backups improve data freshness and are tempting as general resilience, but the dispute is about restore order rather than how recent the data is, so this addresses a different dimension and leaves the contention unresolved.
Why C is wrong: A wholesale regional failover seems to make ordering irrelevant and is tempting, but a destructive attack often corrupts the replicated state and the standby still has finite capacity, so the priority question returns rather than disappearing.
Why D is correct: A pre-agreed criticality tiering with a fixed recovery order removes the contention by telling responders exactly which systems come back first, which is the business resiliency planning the requirement is missing.