In the previous article in this series, we introduced the Business Impact Analysis (BIA), a valuable tool to help us identify and categorize the business functions (a.k.a. activities) based on the impact to business operations in the event of a disruption. The categories range from “critical” to “non-essential.” Using the BIA, we are able to measure the impact in quantitative (dollars) and qualitative (high, medium, low) units and establish key recovery objectives (RTO, RPO, MTD) for each function. A key component of the BIA is a thorough inventory of the resources required to perform each function. Resources include technology, equipment, people, processes, and information.
To complement the BIA, a Threat/Risk Assessment is performed to identify likely events and incidents that threaten to disrupt business operations, measuring both the probability and impact based on existing controls and residual risk.
In this article, we will discuss the process of selecting and implementing cost-effective strategies that minimize risk of downtime and enable the organization to continue performing those functions determined to be most critical, or to recover them in a time frame that meets the desired recovery time objectives (RTO).
For the purpose of this article, we will divide the strategies into four groups or perspectives: