The longer the recovery time objective (RTO), the higher disaster tolerance and the lower the recovery cost. It cannot be concluded that a cold site is inappropriate or that the frequency of data backup would increase.

Section: Protection of Information Assets
Explanation:
Compensating controls are internal controls that are intended to reduce the risk of an existing or potential
control weakness that may arise when duties cannot be appropriately segregated.
Overlapping controls are two controls addressing the same control objective or exposure. Since primary
controls cannot be achieved when duties cannot or are not appropriately segregated, it is difficult to install
overlapping controls. Boundary controls establish the interface between the would-be user of a computer
system and the computer system itself, and are individual-based, not role-based, controls. Access controls
for resources are based on individuals and not on roles.