Then there's the proper level of disaster recovery. I have had clients who could easily be without their systems for a month due to the type of business they ran. Others, however, are so dependent on automated systems that they need a hot site ready for recovery as soon as possible. Most clients are not like either of these, but are unable to easily work manually when their system is unavailable for 2-3 days. For the most part, companies that use MAS 90 choose not to appropriately spend the money or plan for recovery as they should.