ISO 22313:2020 - Guidance on Business Continuity Management Systems 8.2.2: 8.2.2 Business impact analysis

The business impact analysis gives the organization its order for bringing disrupted activities back: its main job is to find and mark as prioritized each activity that may need urgent action when disrupted, because being slow to restore it would cause unacceptable harm; an activity whose recovery takes longer than it can be left down (tolerable for six months, eight months to recover) is prioritized too, so prioritized activities can also be read as those whose solutions may need to exist before any disruption. The organization can use its own words (critical, essential, vital, key), time bands (0 to 2 hours, 0 to 1 day, 1 to 3 days) and grades of priority. Guidance: take in every activity within the BCMS scope, possibly in groups such as those tied to given products and services, and describe operations the way the organization itself does (Figure 6); ISO/TS 22317 goes into more detail and this document sets out a stepwise method. The analysis identifies the harm disruption would do; yields a justified statement of continuity requirements; builds understanding of the products and services and of the activities behind them; sets priorities and timescales for restoring products and services; identifies the resources needed to continue and recover; and identifies dependencies inside and outside. Steps: set assessment criteria fitting the context, including impact types (Table 4: financial, reputational, operational, legal and regulatory, contractual, business objectives) and timescales, reviewed periodically and more often during change; identify the activities that support supply of the products and services; apply the criteria to judge how harm from disruption to each grows over time, allowing for indirect effects, demand cycles and the worst possible timing; estimate the point by which failing to resume becomes unacceptable (top management fixes the impact thresholds, stated as the MTPD (maximum tolerable period of disruption), with the lowest acceptable level stated as the MBCO (minimum business continuity objective)); set, within that point, timescales for resuming activities at a stated minimum acceptable capacity (the recovery time objective, RTO, which can also reflect dependencies and recovery complexity, with several RTOs across a capacity range for complex recoveries); identify the prioritized activities; identify what they depend on in people, information and data, buildings and utilities, equipment and consumables, ICT systems, transport and logistics, finance, and partners and the supply chain; and identify how prioritized activities depend on one another. For information and data, what is needed to resume must be current enough, set by the recovery point objective, RPO, which also fixes how often backups are needed to avoid unacceptable loss of data and work in progress (see ISO/IEC 27031 and ISO/IEC 27002). The documented results include the legal, regulatory and contractual obligations and how they shape continuity requirements; confirmation or revision of the BCMS scope; the assessment of harm over time as the justification for continuity requirements in time and capability; links between products and services, activities and resources; the resources prioritized activities rely on and their reliance on other activities, supply chains, partners and other parties. Inputs can be gathered through interviews, surveys and workshops and from other sources inside and outside.