Cyberstudy
PDF p.403 In progress

Business Impact Analysis

Open PDF at p.403 35 flashcards

Summary

PDF p.403

Business Impact Analysis (BIA) helps businesses understand the potential effects of disruptions on their operations. It involves identifying critical systems, assessing the impact of various threat scenarios, and creating recovery strategies to ensure operational resilience.

In plain words

Supplementary — not from your PDF

A business impact analysis (BIA) works out how disruptions affect operations. It inventories critical systems and assets (people, tangible, intangible, procedures) and uses business process analysis (BPA) to map inputs, hardware, staff, outputs and flow. Mission essential functions (MEF) must be restored first. Key metrics: MTD (max tolerable downtime), RTO (time to recover), WRT (time to reintegrate), RPO (max acceptable data loss in time), plus MTBF (expected lifetime) and MTTR (time to repair).

Detailed explanation

PDF p.403
  • Identification of Critical Systems
    • Definition: Compile an inventory of business processes and supporting assets.
    • Asset Types
      • People: Employees, visitors, suppliers.
      • Tangible Assets: Buildings, furniture, equipment, ICT equipment, electronic data files, paper documents.
      • Intangible Assets: Ideas, commercial reputation, brand.
      • Procedures: Supply chains, critical procedures, standard operating procedures.
    • Dependencies: Reduce dependencies between components by performing a Business Process Analysis (BPA).
  • Business Process Analysis (BPA)
    • Inputs: Sources of information for performing the function.
    • Hardware: Servers or datacenters performing the processing.
    • Staff and Resources: Supporting the function.
    • Outputs: Data or resources produced by the function.
    • Process Flow: Step-by-step description of how the function is performed.
  • Mission Essential Functions (MEF)
    • Definition: Functions that cannot be deferred and must be restored first in case of disruption.
    • Primary Business Functions (PBF): Support the business or MEF but are not critical themselves.
    • Metrics
      • Maximum Tolerable Downtime (MTD): Longest period a business function can be down without causing irrecoverable failure.
      • Recovery Time Objective (RTO): Time to identify and recover from a disaster.
      • Work Recovery Time (WRT): Additional time to reintegrate systems and restore full functionality.
      • Recovery Point Objective (RPO): Maximum acceptable data loss measured in time.
  • Mean Time Metrics
    • Mean Time Between Failures (MTBF): Expected lifetime of a product, calculated as total operational time divided by the number of failures.
    • Mean Time to Repair (MTTR): Time taken to correct a fault and restore full operation, calculated as total hours of unplanned maintenance divided by the number of failure incidents.

Important terms

taken from the text above
Identification of Critical Systems
Compile an inventory of business processes and supporting assets.
People
Employees, visitors, suppliers.
Tangible Assets
Buildings, furniture, equipment, ICT equipment, electronic data files, paper documents.
Intangible Assets
Ideas, commercial reputation, brand.
Procedures
Supply chains, critical procedures, standard operating procedures.
Dependencies
Reduce dependencies between components by performing a Business Process Analysis (BPA).
Inputs
Sources of information for performing the function.
Hardware
Servers or datacenters performing the processing.
Staff and Resources
Supporting the function.
Outputs
Data or resources produced by the function.
Process Flow
Step-by-step description of how the function is performed.
Mission Essential Functions (MEF)
Functions that cannot be deferred and must be restored first in case of disruption.
Primary Business Functions (PBF)
Support the business or MEF but are not critical themselves.
Maximum Tolerable Downtime (MTD)
Longest period a business function can be down without causing irrecoverable failure.
Recovery Time Objective (RTO)
Time to identify and recover from a disaster.
Work Recovery Time (WRT)
Additional time to reintegrate systems and restore full functionality.
Recovery Point Objective (RPO)
Maximum acceptable data loss measured in time.
Mean Time Between Failures (MTBF)
Expected lifetime of a product, calculated as total operational time divided by the number of failures.
Mean Time to Repair (MTTR)
Time taken to correct a fault and restore full operation, calculated as total hours of unplanned maintenance divided by the number of failure incidents.
BIA Business Impact Analysis BPA Business Process Analysis MEF Mission Essential Functions PBF Primary Business Functions MTD Maximum Tolerable Downtime RTO Recovery Time Objective WRT Work Recovery Time RPO Recovery Point Objective MTBF Mean Time Between Failures MTTR Mean Time to Repair

Examples & real-world scenarios

Supplementary — not from your PDF
  • An RPO of 1 hour meaning at most 1 hour of data loss.
  • An RTO of 4 hours to restore a system.
  • MTBF describing a disk's expected lifetime.

Scenario

A business sets RPO to 15 minutes for its order database, so backups or replication must capture changes at least every 15 minutes to meet the acceptable data-loss limit.

Common mistakes

Supplementary — not from your PDF
  • Confusing RTO (recovery time) with RPO (data loss).
  • Confusing MTBF (between failures) with MTTR (to repair).

Practical skills

Supplementary — not from your PDF
  • Distinguish MTD, RTO, WRT and RPO.
  • Explain MTBF and MTTR.

What I should remember

Key Points PDF p.403
  • Identification of Critical Systems
    • Inventory: Business processes and supporting assets.
    • Asset Types: People, tangible assets, intangible assets, procedures.
  • Business Process Analysis (BPA)
    • Analyze Dependencies: Inputs, hardware, staff, outputs, process flow.
  • Mission Essential Functions (MEF)
    • Critical Functions: Must be restored first.
    • Metrics: MTD, RTO, WRT, RPO.
  • Mean Time Metrics
    • MTBF: Expected product lifetime.
    • MTTR: Time to repair and restore functionality.