Backups and mirror-copies of data are an essential part of RPO solutions. If a business wants to reduce their CAPEX for disaster recovery, which of the following solutions are applicable?

Annual cybersecurity assessments or penetration tests are risk management practices that have no direct impact on capital expenditure for disaster recovery infrastructure.

Renewing backup software annually is an OPEX software licensing cost and does not eliminate the underlying hardware CAPEX associated with maintaining backup infrastructure.

Cloud providers offer DR-as-a-Service and backup-as-a-Service models where organizations pay only for storage and compute consumed during failover tests or actual disasters, eliminating the need to purchase, house, and maintain a secondary physical infrastructure site - converting CAPEX to OPEX and lowering upfront investment.

Building a redundant infrastructure at a secondary physical location increases CAPEX by requiring additional hardware procurement, facility costs, and ongoing maintenance for a second data center.