As I understand it, the second site will allow them to resume operating at a limited capacity sooner than 2-4 weeks?

Other than that 2-4 does sound more like hardware lead time rather than time it takes to resolve a security incident.