Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Business Continuity Mt Xia Inc May 2011 Business Impact Analysis http://www.mtxia.com 615.556.0456
Objectives of Business Impact Analysis <ul><li>In this outline, we will  </li></ul><ul><li>Learn the importance of targeti...
BIA is a component of DRP Disaster Recovery Planning Business As Usual  Project Goals Identify Threats Business Impacts De...
Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Da...
Purpose of Business Impact Analysis <ul><li>To quantify effect of disruption on business operations </li></ul><ul><ul><li>...
The BIA Process <ul><li>Identify main business functions </li></ul><ul><ul><li>For example, sales, marketing, finance, man...
Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Da...
Membership of BIA Team <ul><li>First decide who should be involved </li></ul><ul><ul><li>Senior management and board membe...
Who Contributes to BIA <ul><li>Functional Managers </li></ul><ul><ul><li>Usually the most appropriate contributors </li></...
BIA Detailed and Local Knowledge <ul><li>Site or geography managers </li></ul><ul><ul><li>Good overview of all functions <...
Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Da...
Gathering BIA Data <ul><li>What data do we need to gather? </li></ul><ul><ul><li>Fundamental purpose of the function </li>...
BIA Questionnaires <ul><li>Designing and using questionnaires </li></ul><ul><ul><li>Make it easy for targets to respond </...
BIA Interviews <ul><li>Structured interviews </li></ul><ul><ul><li>Time-consuming and costly </li></ul></ul><ul><ul><li>Ca...
BIA Workshops <ul><li>Focused workshop </li></ul><ul><li>Recommended approach </li></ul><ul><ul><li>Quick </li></ul></ul><...
Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Da...
Business Perspective of BIA <ul><li>Creates a statement of  </li></ul><ul><ul><li>The critical operational needs </li></ul...
IT Perspective of BIA <ul><li>From an IT perspective </li></ul><ul><ul><li>Driven by the business perspective of must-have...
Recovery Plan Document – By When?
Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Da...
Application Categories <ul><li>Keep it simple using three categories </li></ul><ul><ul><li>1 = essential to organization's...
Summary <ul><li>In this outline, we have seen that BIA concerns </li></ul><ul><ul><li>Identifying the cost of disruption i...
Contact Information <ul><li>Mt Xia Inc. </li></ul><ul><ul><li>http://www.mtxia.com </li></ul></ul><ul><ul><li>Dana French,...
Upcoming SlideShare
Loading in …5
×

Business Impact Analysis

8,638 views

Published on

Overview of conducting a Business Impact Analysis (BIA) for the purpose of Business Continuity and Disaster Recovery Planning.

Business Impact Analysis

  1. 1. Business Continuity Mt Xia Inc May 2011 Business Impact Analysis http://www.mtxia.com 615.556.0456
  2. 2. Objectives of Business Impact Analysis <ul><li>In this outline, we will </li></ul><ul><li>Learn the importance of targeting solutions at those areas with maximum impact on the business </li></ul><ul><li>By deciding </li></ul><ul><li>Who resources the business impact analysis team </li></ul><ul><li>How to gather impact data </li></ul><ul><li>What are the consequences for IT of identified business impacts </li></ul>
  3. 3. BIA is a component of DRP Disaster Recovery Planning Business As Usual Project Goals Identify Threats Business Impacts Design Contingent Produce Plan Test and Deploy Maintain the DR Plan Identify Critical Processes Identify IT Resources
  4. 4. Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Data </li></ul><ul><li>Business and IT Perspectives </li></ul><ul><li>Categorizing Applications </li></ul>
  5. 5. Purpose of Business Impact Analysis <ul><li>To quantify effect of disruption on business operations </li></ul><ul><ul><li>Financial and functional impact </li></ul></ul><ul><li>Business-focused </li></ul><ul><ul><li>Enables or justifies decision on what to protect at what cost </li></ul></ul><ul><li>To identify and classify backup resources </li></ul><ul><ul><li>Divide the musts from the wants for assurance of business continuity </li></ul></ul>
  6. 6. The BIA Process <ul><li>Identify main business functions </li></ul><ul><ul><li>For example, sales, marketing, finance, manufacturing, IT, et al. </li></ul></ul><ul><li>Identify major activities of each function </li></ul><ul><li>Identify dependencies for all major activities </li></ul><ul><ul><li>Must include all prerequisites or facilitators </li></ul></ul><ul><ul><ul><li>For example, ICT infrastructure and applications </li></ul></ul></ul><ul><ul><li>Manufacturing facilities, raw materials, customer contact centers, etc. </li></ul></ul><ul><ul><li>Accommodation and transportation </li></ul></ul><ul><li>Quantify consequence from the loss of prerequisites </li></ul>
  7. 7. Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Data </li></ul><ul><li>Business and IT Perspectives </li></ul><ul><li>Categorizing Applications </li></ul>
  8. 8. Membership of BIA Team <ul><li>First decide who should be involved </li></ul><ul><ul><li>Senior management and board members </li></ul></ul><ul><ul><li>Functional managers </li></ul></ul><ul><ul><li>Divisional managers </li></ul></ul><ul><ul><li>Site or geography managers </li></ul></ul><ul><ul><li>Operational staff </li></ul></ul><ul><li>Board-level senior managers </li></ul><ul><ul><li>May be appropriate for small companies </li></ul></ul><ul><ul><li>Too far from the action in large organizations </li></ul></ul><ul><ul><li>But </li></ul></ul><ul><ul><ul><li>Can set corporate objectives and priorities </li></ul></ul></ul><ul><ul><ul><li>Can add credibility and authority to project </li></ul></ul></ul>
  9. 9. Who Contributes to BIA <ul><li>Functional Managers </li></ul><ul><ul><li>Usually the most appropriate contributors </li></ul></ul><ul><ul><ul><li>Sales, marketing, manufacturing, finance </li></ul></ul></ul><ul><ul><li>Focused on a single business function </li></ul></ul><ul><ul><li>Generally have a rational view on its place in the overall business </li></ul></ul><ul><ul><li>May need to consult with their supervisory and operational staff to identify all touch-points on IT systems </li></ul></ul><ul><li>Divisional managers </li></ul><ul><ul><li>Divisions may often be treated individually as small companies </li></ul></ul><ul><ul><li>Approach and format should be consistent </li></ul></ul><ul><ul><li>Each division may wish to field its own management team </li></ul></ul><ul><ul><li>Potential difficulty with representation of cross-divisional functions </li></ul></ul>
  10. 10. BIA Detailed and Local Knowledge <ul><li>Site or geography managers </li></ul><ul><ul><li>Good overview of all functions </li></ul></ul><ul><ul><li>May be appropriate to treat each site as individual company </li></ul></ul><ul><ul><li>Approach and format should be consistent </li></ul></ul><ul><li>Operational staff </li></ul><ul><ul><li>Good knowledge of fine detail </li></ul></ul><ul><ul><li>Need to keep in perspective </li></ul></ul><ul><ul><li>Typically too many for workshop session </li></ul></ul><ul><ul><li>Less cross-functional understanding </li></ul></ul><ul><ul><li>Need to ensure level of contribution is consistent across different functional areas </li></ul></ul>
  11. 11. Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Data </li></ul><ul><li>Business and IT Perspectives </li></ul><ul><li>Categorizing Applications </li></ul>
  12. 12. Gathering BIA Data <ul><li>What data do we need to gather? </li></ul><ul><ul><li>Fundamental purpose of the function </li></ul></ul><ul><ul><li>Activities performed to achieve the purpose </li></ul></ul><ul><ul><li>Resources required to perform the activities </li></ul></ul><ul><ul><li>Consequences of non-availability of those resources </li></ul></ul><ul><li>How to gather the data </li></ul><ul><ul><li>Questionnaires </li></ul></ul><ul><ul><li>Structured interviews </li></ul></ul><ul><ul><li>Focused workshops </li></ul></ul><ul><li>Organizing the data </li></ul><ul><ul><li>Categorize requirements </li></ul></ul><ul><ul><li>Document the results </li></ul></ul><ul><ul><li>Text, spreadsheets, or database </li></ul></ul><ul><ul><li>Purpose-designed software </li></ul></ul>
  13. 13. BIA Questionnaires <ul><li>Designing and using questionnaires </li></ul><ul><ul><li>Make it easy for targets to respond </li></ul></ul><ul><ul><li>Convenient </li></ul></ul><ul><ul><li>Don't have to get all players together at one time </li></ul></ul><ul><ul><li>Results need sanity checking </li></ul></ul><ul><ul><li>Time-consuming to achieve good results </li></ul></ul><ul><ul><li>Can precede workshop (to set the agenda, for example) </li></ul></ul><ul><li>Need skill and care to prepare effective questionnaire and avoid pitfalls </li></ul><ul><ul><li>Leading the audience toward an answer </li></ul></ul><ul><ul><li>Danger of poorly considered response – completed in a hurry </li></ul></ul><ul><ul><li>Poor response rates – or not completed at all </li></ul></ul><ul><ul><li>Frequently need to contact respondents to clarify answers </li></ul></ul><ul><ul><li>Easy for recipients to avoid hard or unpleasant concerns </li></ul></ul><ul><ul><li>Inability to elicit full, frank information </li></ul></ul><ul><ul><li>“ You didn't ask that” </li></ul></ul>
  14. 14. BIA Interviews <ul><li>Structured interviews </li></ul><ul><ul><li>Time-consuming and costly </li></ul></ul><ul><ul><li>Capable of good results </li></ul></ul><ul><ul><li>Danger of narrow thinking </li></ul></ul><ul><ul><li>Results need sanity Checking </li></ul></ul>
  15. 15. BIA Workshops <ul><li>Focused workshop </li></ul><ul><li>Recommended approach </li></ul><ul><ul><li>Quick </li></ul></ul><ul><ul><li>Lower cost than alternatives </li></ul></ul><ul><ul><li>Highly effective </li></ul></ul><ul><ul><li>Synergy from group </li></ul></ul><ul><ul><li>Moderation from peers in real time </li></ul></ul><ul><ul><li>Common understanding and decision criteria </li></ul></ul><ul><li>Drawbacks </li></ul><ul><ul><li>Difficult to schedule </li></ul></ul><ul><ul><li>Needs good facilitator </li></ul></ul><ul><ul><li>May still need follow-up </li></ul></ul>
  16. 16. Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Data </li></ul><ul><li>Business and IT Perspectives </li></ul><ul><li>Categorizing Applications </li></ul>
  17. 17. Business Perspective of BIA <ul><li>Creates a statement of </li></ul><ul><ul><li>The critical operational needs </li></ul></ul><ul><ul><li>How quickly I need it back </li></ul></ul><ul><ul><ul><li>How do I meet catch-up implications after the information systems become available again? </li></ul></ul></ul><ul><ul><li>How much I can afford to have lost when the process is restored </li></ul></ul><ul><ul><li>The (non-IT) resources that are essential for me to achieve my fundamental purpose </li></ul></ul><ul><ul><ul><li>What do I need to do to ensure their availability? </li></ul></ul></ul><ul><li>Identifies critical business applications </li></ul><ul><ul><li>Time scales and impacts </li></ul></ul><ul><ul><li>Document in the DR plan </li></ul></ul><ul><li>Drives the IT perspective of BIA </li></ul>
  18. 18. IT Perspective of BIA <ul><li>From an IT perspective </li></ul><ul><ul><li>Driven by the business perspective of must-have applications </li></ul></ul><ul><li>Drivers </li></ul><ul><ul><li>What are the dependencies of the application? </li></ul></ul><ul><ul><ul><li>What other applications are required for it to function? </li></ul></ul></ul><ul><ul><ul><li>What infrastructure (hardware, software, networking, etc.) does it require? </li></ul></ul></ul><ul><ul><li>How soon must it be available and what is the acceptable restart position? </li></ul></ul><ul><ul><li>What volumes, timings, and user population are required in disaster mode? </li></ul></ul><ul><ul><li>Is there a backup regime appropriate to these needs? </li></ul></ul><ul><ul><li>Does the application support a staged/phased recover, or is it all or nothing? </li></ul></ul><ul><ul><li>How will we protect it during DR mode operation? </li></ul></ul><ul><li>Identifies supporting infrastructure of the critical business applications </li></ul><ul><ul><li>Document in the DR plan </li></ul></ul>
  19. 19. Recovery Plan Document – By When?
  20. 20. Business Impact Analysis <ul><li>Purpose and Process </li></ul><ul><li>Who is Involved? </li></ul><ul><li>How to Gather Data </li></ul><ul><li>Business and IT Perspectives </li></ul><ul><li>Categorizing Applications </li></ul>
  21. 21. Application Categories <ul><li>Keep it simple using three categories </li></ul><ul><ul><li>1 = essential to organization's ability to operate </li></ul></ul><ul><ul><li>2 = significantly reduces the organization's capabilities or profitability </li></ul></ul><ul><ul><li>3 = useful, but not important in the short term </li></ul></ul><ul><li>Restoring applications </li></ul><ul><ul><li>Category 1, as soon as possible within limits specified by the BIA </li></ul></ul><ul><ul><li>Category 3, put to one side for consideration later </li></ul></ul><ul><ul><li>Category 2, do simple cost/benefit analysis to ensure response is appropriate to need </li></ul></ul>
  22. 22. Summary <ul><li>In this outline, we have seen that BIA concerns </li></ul><ul><ul><li>Identifying the cost of disruption in functional and financial terms </li></ul></ul><ul><ul><li>Setting priority for restoring applications according to business needs </li></ul></ul><ul><li>Meaningful BIA is dependent on </li></ul><ul><ul><li>Appropriate contributors </li></ul></ul><ul><ul><li>Appropriate data gathering techniques </li></ul></ul><ul><li>BIA output is viewed from two perspectives </li></ul><ul><ul><li>Business Perspective </li></ul></ul><ul><ul><ul><li>People, processes, non-IT resources, recovery time, musts/wants </li></ul></ul></ul><ul><ul><li>IT Perspective </li></ul></ul><ul><ul><ul><li>Technology resources required to deliver business applications in time scale demanded </li></ul></ul></ul>
  23. 23. Contact Information <ul><li>Mt Xia Inc. </li></ul><ul><ul><li>http://www.mtxia.com </li></ul></ul><ul><ul><li>Dana French, President </li></ul></ul><ul><ul><li>615.556.0456 </li></ul></ul>

×