Computer systems are generally covered by back up arrangements and this is considered
standard contingency practice. Where this back up takes the form of a complete disaster centre,
then this is a mitigation measure since it incurs costs on an ongoing basis. Failure to provide
mitigation/contingency in any of these (and other dimensions) is a driver of risk.