Business Impact Analysis (BIA) and Business Processes

C.

The Business Impact Analysis (BIA) identifies time-critical aspects of the critical business processes, and determines their maximum tolerable downtime.The BIA helps to Identify organization functions, the capabilities of each organization unit to handle outages, and the priority and sequence of functions and applications to be recovered, identify resources required for recovery of those areas and interdependencies In performing the Business Impact Analysis (BIA) it is very important to consider what the dependencies are.

You cannot bring a system up if it depends on another system to be operational.

You need to look at not only internal dependencies but external as well.

You might not be able to get the raw materials for your business so dependencies are very important aspect of a BIA.

The BIA committee will not truly understand all business processes, the steps that must take place, or the resources and supplies these processes require.

So the committee must gather this information from the people who do know department managers and specific employees throughout the organization.

The committee starts by identifying the people who will be part of the BIA data-gathering sessions.

The committee needs to identify how it will collect the data from the selected employees, be it through surveys, interviews, or workshops.

Next, the team needs to collect the information by actually conducting surveys, interviews, and workshops.

Data points obtained as part of the information gathering will be used later during analysis.

It is important that the team members ask about how different tasks whether processes, transactions, or services, along with any relevant dependencies get accomplished within the organization.

The following answers are incorrect: composition This is incorrect because it is not the best answer.

While the make up of business may be important, if you have not determined the dependencies first you may not be able to bring the critical business processes to a ready state or have the materials on hand that are needed.

priorities This is incorrect because it is not the best answer.

While the priorities of processes are important, if you have not determined the dependencies first you may not be able to bring the critical business processes to a ready state or have the materials on hand that are needed.

service levels This is incorrect because it is not the best answer.

Service levels are not as important as dependencies.

Reference(s) used for this question: Schneiter, Andrew (2013-04-15)

Official (ISC)2 Guide to the CISSP CBK, Third Edition : Business Continuity and Disaster Recovery Planning (Kindle Locations 188-191).

Kindle Edition.

and Harris, Shon (2012-10-25)

CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 18562-18568)

McGraw-Hill.

Kindle Edition.

During the Business Impact Analysis (BIA), the focus is on identifying the critical business processes, understanding the potential impacts of disruptions to those processes, and identifying the appropriate strategies to mitigate those risks.

Out of the options provided, the most important factor to be emphasized during the BIA is dependencies. Dependencies refer to the relationships between different business processes and systems that are necessary for the smooth functioning of the organization. Understanding these dependencies is critical because a disruption to one process can have a cascading effect on other processes.

For example, if a critical system used by multiple departments fails, it can cause a ripple effect throughout the organization, impacting operations, revenue, customer satisfaction, and even reputation. Therefore, it is essential to identify the dependencies between different processes and systems, and prioritize their recovery based on their criticality to the organization.

While composition, priorities, and service levels are also important factors to consider during the BIA, they are not as critical as understanding dependencies. Composition refers to the makeup of the business processes, priorities refer to the order in which processes should be restored, and service levels refer to the agreed-upon levels of service that the organization must provide to its customers.

In summary, during the Business Impact Analysis, the emphasis should be on understanding the dependencies between different business processes and systems to prioritize their recovery based on their criticality to the organization.