The Business Impact Analysis (BIA) identifies time-critical aspects of the critical
business processes, and determines their maximum tolerable downtime. The BIA helps to Identify
organization functions, the capabilities of each organization unit to handle outages, and the priority
and sequence of functions and applications to be recovered, identify resources required for
recovery of those areas and interdependencies
In performing the Business Impact Analysis (BIA) it is very important to consider what the
dependencies are. You cannot bring a system up if it depends on another system to be
operational. You need to look at not only internal dependencies but external as well. You might not
be able to get the raw materials for your business so dependencies are very important aspect of a
BIA.
The BIA committee will not truly understand all business processes, the steps that must take
place, or the resources and supplies these processes require. So the committee must gather this
information from the people who do know- department managers and specific employees
throughout the organization. The committee starts by identifying the people who will be part of the
BIA data-gathering sessions. The committee needs to identify how it will collect the data from the
selected employees, be it through surveys, interviews, or workshops. Next, the team needs to
collect the information by actually conducting surveys, interviews, and workshops. Data points
obtained as part of the information gathering will be used later during analysis. It is important that
the team members ask about how different tasks- whether processes, transactions, or services,
along with any relevant dependencies- get accomplished within the organization.
The following answers are incorrect:
composition This is incorrect because it is not the best answer. While the make up of business
may be important, if you have not determined the dependencies first you may not be able to bring
the critical business processes to a ready state or have the materials on hand that are needed.
priorities This is incorrect because it is not the best answer. While the priorities of processes are
important, if you have not determined the dependencies first you may not be able to bring the
critical business processes to a ready state or have the materials on hand that are needed.
service levels This is incorrect because it is not the best answer. Service levels are not as
important as dependencies.
Reference(s) used for this question:
Schneiter, Andrew (2013-04-15). Official (ISC)2 Guide to the CISSP CBK, Third Edition : Business
Continuity and Disaster Recovery Planning (Kindle Locations 188-191). . Kindle Edition.
and
Harris, Shon (2012-10-25). CISSP All-in-One Exam Guide, 6th Edition (Kindle Locations 18562-
18568). McGraw-Hill. Kindle Edition.