Business Impact Analysis Walkthrough Template
Explore the essentials of Business Impact Analysis (BIA) through a basic template example, highlighting the importance of inventory, documentation, prioritization, and service descriptions in ensuring organizational resilience and preparedness. Learn how to identify critical systems, assess outage impacts, set recovery objectives, and prioritize resources effectively.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Marc Scarborough Information Security Officer Rice University marcs@rice.edu
Business Impact Analysis (BIA) Walk Through a Basic Template Example General Notes Questions Links
From NIST (your tax dollars at work): The purpose of the BIA is to identify and prioritize system components by correlating them to the mission/business process(es) the system supports, and using this information to characterize the impact on the process(es) if the system were unavailable. identify and prioritize
Inventory When is the last time you had a good inventory of the systems performing your mission critical work? Documentation In an emergency situation do people know what to do? Prioritization Knowing what is integral in supporting critical University functions and its mission before something happens is good to know.
Service Description Outage Impact Maximum Tolerable Downtime Recovery Time Objectives Resource Requirements Recovery Priorities for System Resources
A primary focus of the BIA is to identify systems that support services critical to the University. The Service Description should include as much information as is not available elsewhere. As documentation for services progresses, pointers to existing, more often updated information might be more appropriate, if it contains the right information.
Description of what the service provides Hardware and software Customers potentially impacted, both internal and external, due to outages Contact information as well Systems and services that depend on it Systems and services that it depends on Vendor and support contact information
Which services should receive priority during or after an emergency should be determined by how much (and how quickly) that service impacts operations within the University
When a service goes offline, how does it impact operations in the University? How long until operations are impacted? How long until operations are halted? Maximum Tolerable Downtime (MTD) How long will it take to recover? Recovery Time Objectives (RTO) Many IT services support several University operations Outage impact should be analyzed for each
MTD This is represented as the absolute maximum time that can be tolerated for a University operation to be stopped. For example, how long can the University go without the ability to pay for services? Each operation the service facilitates should have this information.
RTO This is represented as the time a system (not an operation) is unavailable before potentially affecting other systems. For example, how long can DNS stay down before Email goes down, affecting University business? This should be smaller than the MTD, and include time to restore information or re-run processes (like tape restores), all within the MTD window.
The systems, hardware and software that support the service should be listed here. This might contain items from the Service Description section as well as specific dependencies.
Which systems and resources should be restored to service first? Now that the critical University operations, impacts to the campus, tolerable downtimes and service components have been identified, prioritize the recovery steps by system and resource.
Maximum Tolerable Downtime and Recovery Time Objective
Its late in the day... Remember what the BIA is designed to help you do: Identify and prioritize Help with both continuity and recovery planning The template I use is based on NIST guidelines, but each University will most likely need to create or modify one that works for them. Thank you
NIST http://csrc.nist.gov/publications/nistpubs/800- 34-rev1/sp800-34-rev1.pdf
