DivisionCero

Business Impact Analysis (BIA) Procedure

Methodology for business continuity impact analysis (BIA)

Purpose

Determine critical processes, prioritize their recovery after disruptions and define the necessary resources, considering internal and external dependencies.

Scope

Applies to all of the organization's business processes and facilities.

Objectives

  • Identify critical processes and systems.
  • Assess the impact of disruptions.
  • Define recovery requirements and windows.
  • Identify dependencies.
  • Prioritize business functions.

Key Definitions

  • BIA: Analysis of functions and the effects of disruptions.
  • MBCO: Minimum acceptable level of services during a disruption.
  • MTPD: Maximum tolerable time before unacceptable impacts.
  • RPO: Point to which data must be restored.
  • RTO: Maximum time to resume a service or process.
  • SME: Subject matter experts.

Responsibilities

  • Management: Review the BIA, assess losses and determine recovery times.
  • BCM: Plan workshops, gather information, analyze data, assess risks and develop recovery plans.

Training Standards

  • Formal annual training on risk, incidents and compliance.
  • Periodic awareness campaigns.
  • Security training during staff onboarding.
  • Attendance records and refresher sessions.

Procedure

  1. Information Gathering: Interviews, questionnaires and workshops to describe business services and activities.

  2. Assessment and Analysis:

    • Assess the impact of disruptions using BIA criteria.
    • Rate economic, social, legal, technological and environmental impacts.
    • Assess the time scale: 4 hours to 30 days.
    • Document assumptions and ratings to develop recovery strategies.

  3. Defining Critical Objectives:

    • RPO: Data restoration point.
    • RTO: Maximum time to resume services.
    • MBCO: Minimum acceptable level of continuity.
    • MTPD: Maximum tolerable disruption time.

  4. Prioritizing Functions: Determine critical processes and dependencies to guide recovery.

Monitoring and Review

  • Regular reviews to assess the effectiveness of the BIA.
  • Periodic reports to management.
  • Updates based on operational or environmental changes.

Business Continuity Plan

Framework for responding to disruptive incidents affecting operations and ensuring essential functions

Crisis Management Policy

Framework for responding to and managing organizational crisis situations

On this page

PurposeScopeObjectivesKey DefinitionsResponsibilitiesTraining StandardsProcedureMonitoring and Review