The Business Impact Analysis (BIA) is the foundation, the heart and soul of the research in building the Business Continuity Plan (BCP). The BIA is an analytical process that examines a community’s business functional areas, assesses them for mission criticality and prioritizes them in a manner that they must be protected and/or brought back on line post crisis. The BIA also identifies what dependencies the Mission Critical Activity (MCA) has, the vital records, Service Level Agreements (SLA), contracts or Memorandums of Understanding (MOUs), as well as details the resources that the activity requires to perform its function. The key deliverable of the BIA is the development of appropriate recovery strategies for those business functions that are critical to the community.
For each of the Business Functional Areas (BFAs) identified, specific information must be captured. This task drills down in to the detailed specific work that is required to successfully complete each piece of work identified previously. Tracking what specific activity, its deliverables, the resources required and the consequences to the community if this work should fail are detailed here so that an appropriate Return Time Objective (RTO) can be established. The RTO of an MCA provides an optimum time goal to have the predetermined work available to the users on a predetermined and pre-established time line. This assists in identifying where resources, planning and effort must be expended to protect the service to the community’s best abilities, and when it cannot be protected, its down time needs to be safeguarded and the MCA brought back on line within the RTO time window.
The RTO for each activity is established and then analyzed and compared with all of the BFAs within this Area of Responsibility and prioritized. This in turn is analyzed and compared with all the other prioritized activity RTOs of all of the Areas of Responsibility and again prioritized at a high level to identify the community’s Mission Critical Activities in a prioritized list. Which activity must be maintained / safeguarded or returned to service fist, second or third etc. When completing this analysis all dependencies must be taken into account, ie if an MCA requires power then the establishment of power must be first over the MCA, if the MCA requires telecommunications which is dependant on power then power is first, telecommunications is second and the MCA becomes third.
In order to fully appreciate these requirements and dependencies, one must dissect the work into its requirements and resources. The BIA is usually conducted by interviewing the subject matter experts and those accountable and responsible for the work, as they are intimately knowledgeable of what is required to make the work happen. Questionnaires or data capture sheets can be very useful to capture information in a consistent and meaningful way. The BCM Manager must custom design and develop a process to capture appropriate information so that comprehensive analysis can be made at the end of the day.