So, you’ve convinced management to let you conduct a BIA. Congratulations! However, if you are tempted to immediately jump in and start setting up interviews, I hope you will hold on for a moment.
A proper business impact analysis requires preparation. You wouldn’t jump into a body of water without changing into swim trunks – or at least taking everything out of your pockets – and similar measures are required before you start on a BIA. Preparing for a BIA is critical to its success.
In this article, we’re going to outline the prep work required to conduct a solid BIA, one which is worth your while and creates tangible results.
Determine Your Strategy for the BIA
The first step in preparing for a BIA is to determine your strategy. There are four from which to choose:
- Formal BIA. This is what most people have in mind when they talk about BIAs. A formal BIA uses a multiphase process consisting of interviewing stakeholders; choosing and weighting impact categories; calculating recovery time objectives (RTOs); and reviewing and discussing dependencies, applications, and recovery point objectives (RPOs). This process provides the most accurate and comprehensive results and is the most likely to uncover overlooked exposures, but it takes the most time and resources.
- Informal BIA. This strategy uses quick, informal interviews where participants, rather than assigning scores to the various impacts, discuss the timing of when a process needs to be functional and why. The discussions might also look at the applications needed, and they tend to focus only on critical dependencies.
- Questionnaire-based BIA. This strategy involves obtaining the necessary information using a questionnaire, following up with the respondents as needed. In using this method, care must be given to the preparation of the questionnaire to make sure it requests all the desired information. Such questionnaires typically try to acquire information similar to that gathered in the informal interview.
- Hybrid BIA. This strategy involves using a combination of formal and informal processes, varying the method by department. Which method is used is decided based on such factors as the department’s criticality, whether it was recently reorganized, and when its most recent BIA was performed.
Most organizations choose their strategy by considering such factors as how long it’s been since the previous BIA, the degree of support in the organization for doing the BIA, the available budget and resources, and the estimated seriousness of the organization’s gaps and exposures.
Determine Your RTOs and RPOs
Another step in preparing for a BIA is determining your recovery time objectives (RTOs) and recovery point objectives (RPOs).
The RTO is the amount of time, subsequent to a disruption, before which a process or application should be restored in order to avoid an unacceptable level of impact. For example, an RTO of eight hours for a certain process means that process needs to be restored within eight hours of the disruption to avoid a level of impact which management has deemed to be unacceptably high.
The RPO applies to processes that involve data storage. It is the maximum time period for which management is willing to accept the loss of data for a given process. For example, an RPO of one hour for a process would mean measures must be in place to securely protect its data (replication or backup) at least once every hour, because management has determined data losses greater than one hour for that process would create an unacceptably high negative impact on the enterprise.
Here are some things to keep in mind about RTOs and RPOs as they relate to BIAs:
- Before performing the BIA, ensure the RTO and RPO categories have been defined and approved by appropriate management.
- Ensure the people participating in the BIA understand the concepts of RTOs and RPOs and have the pertinent information on the values selected.
- Be careful not to define too many values for the RTO and RPO.
- The categories are used to define recovery strategies as well as understand the time required for recovery.
- From a recovery strategy perspective, there is really no difference between an RTO of “< 12 hours” and “< 8 hours.”
- The same is true of the data protection strategy. There is a significant difference between an RPO of “zero data loss” and “< 4-hour data loss,” but there is no significant difference “< 8 hours” and “< 4 hours.”
- If a process needs an RTO or RPO which is less than the defined category, note that as part of the BIA information. For example, a process which needs to be available in 8 hours (but not 4 hours) is still an RTO of “< 12 hours.” Note the request or requirement. Do not create a new category.
The tables below give examples of the RTO and RPO categories typically used in BIAs:
Determine the Scoring Categories and Ranges
The next step in your preparations will be to determine your impact categories and their scoring and ranges.
The tables below give examples of the scoring of qualitative and quantitative impact categories such as would be used in a formal BIA. This approach could be modified or reduced for use in an informal or questionnaire-based BIA.
For the quantitative category, determine the dollar range for each score. This will be different for each organization.
The dollar range is often based on the revenue of the organization and how much it is willing to lose, with the amount then being broken down relatively evenly across the score values.
Determine the Departments and Participants
Another important step in getting ready to conduct your BIA is determining which departments and individuals will participate.
Ideally, your BIA would include all the departments in the organization; however, time and budgetary constraints might make this unfeasible.
If this is the case, you will need to identify the most critical processes and departments.
If you are conducting a hybrid BIA, you might decide to conduct formal BIAs for those departments judged critical and informal BIAs for the departments judged less critical (in terms of their time sensitivity in the event of a disruption).
Once you have selected the departments for which you will be conducting BIAs, you will need to identify which individuals in each department you will be contacting.
Include both management and individual contributors, but do not try to include all individuals performing a process or in a department.
Try to select individuals who are capable of seeing the impact the process has across the organization.
Develop the Questionnaire or Pre-Work Document
Whether you are conducting a formal or informal BIA, we recommend you develop a questionnaire or “pre-work” document for the departments to complete prior to the interview to help facilitate the discussion.
Ensure the document asks the right questions and requests an appropriate level of detail and information. You should also include an example showing how to fill out the document.
Especially important is the level of granularity of the business processes. Ensure the processes covered in your pre-work document are functional business processes, not outage event types, work tasks, or recovery tasks.
Preparation Is the Key to Success
No matter what BIA strategy you use, preparing for a BIA is the key to making it efficient and effective.
As a final thought, when it comes to BIAs, something is better than nothing. Even an informal “back-of-the-envelope” discussion on process RTO needs and the required applications will get you the information necessary to develop a basic strategy, as well as providing IT with information it can use to start on the technology recovery strategy.
Good luck on your BIA!
Takeaways
- The first step in getting ready to do a BIA is to choose one of the four available strategies: formal, informal, questionnaire-based, or hybrid.
- The next step is to determine your RTOs and RPOs.
- Other steps include determining your impact categories and scoring ranges, identifying which departments and individuals will participate, and developing the pre-work questionnaire.
- Quality preparation is the key to success.
