Purpose
Identify critical activities and dependencies and establish approved recovery priorities and objectives. The Business Impact Analysis (BIA) identifies the impact of disruptions on critical functions and defines the metrics necessary for survival and compliance.
Preconditions
- Current service, process, system, data, personnel, premises and supplier inventories are available.
- Responsible service and process owners participate.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Identify critical functions | Business services, activities, regulatory obligations within scope; functions necessary for survival and compliance | Critical function inventory |
| 2 | Assess impact over time | Operational, customer, financial, legal, regulatory, reputational impacts of disruption | Impact assessment |
| 3 | Identify dependencies | Personnel, premises, technology, information, and third-party dependencies | Dependency inventory |
| 4 | Determine MTPD | Maximum Tolerable Period of Disruption for each critical function — max unavailability before unacceptable damage | MTPD register |
| 5 | Establish RTOs and RPOs | Recovery Time Objectives to restore operations; Recovery Point Objectives for acceptable data loss; consistent with impact tolerance | RTO/RPO register |
| 6 | Prioritize recovery | Identify minimum resource and operating-capacity requirements for recovery | Recovery priority list |
| 7 | Obtain owner approval | Management review, resolve inconsistencies, record approval | Approved BIA |
| 8 | Review BIA periodically | At least annually and after significant organizational or technological changes | Review record |
Exceptions and Escalation
Conflicting recovery objectives, unsupported objectives or missing critical dependencies shall be escalated to management for risk acceptance or treatment.
Records
- Completed and approved BIA
- Critical activity and dependency inventory
- MTPD, RTO and RPO register
- Review and change records
Relationships
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-BCM-002 Ensure BIA and Recovery Objectives Are Current
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: annual and after significant change
History
- 2026-07-26: Created from section 6 of the approved Business Continuity Manual.