Lion Cipher Lab
Do a Business Impact Analysis (BIA)
- GRC / Compliance
- Beginner
- ~50 min
- Free · no account required
Why it matters
Before anyone can recover from a disaster, someone has to decide what is worth recovering first -- and in a real outage you cannot save everything at once. A Business Impact Analysis (BIA) is the artifact that makes that call in advance, in writing, while everyone is calm: it lists every important thing your organization does, rates how badly it would hurt if each one stopped, and sets two numbers per activity -- how fast it must be back, and how much recent data it can afford to lose. Those numbers, RTO and RPO, are the exact ones an executive, an auditor, or a cyber-insurer asks for first,…
What you'll learn
- what a Business Impact Analysis (BIA) is and where it fits
- inventorying business processes (not just servers)
- rating process criticality by the harm caused when it stops
- Maximum Tolerable Downtime (MTD)
- setting a Recovery Time Objective (RTO) per process
- setting a Recovery Point Objective (RPO) per process
- telling RTO and RPO apart
- mapping processes to the systems they depend on
- prioritizing recovery so a DR plan knows what to save first
- GRC and resilience fundamentals
Steps in this lab
- What a BIA is, and why it comes before the recovery plan
- Open a spreadsheet and write your scope at the top
- Inventory your business processes -- activities, not machines
- Rate criticality -- how badly it hurts when a process stops
- Maximum Tolerable Downtime -- how long before it really hurts
- Build the columns and drop in the worked example
- Set RTO and RPO -- the two numbers a BIA exists to produce
- Map dependencies and name an owner for each process
- Sort by criticality -- the ranked list you can hand to a recovery plan
- What you built, and the mindset to keep