To BIA

BCM or not to
BIA?
The Key Questions

“Securing our Digital City” Ian Charters FBCI

Presentation at CSM-ACE 2010 – 26th October 2010

Why do a BIA?
‹ What is a BIA?
‹ When do we do a BIA?
‹ How do we measure disruption cost?
‹ Do we update the BIA every year?
‹ So is it worth it?
What is a BIA?
‹ The process of analysing business functions and the
effect that a business disruption might have upon them
(BS 25999 & BCI Good Practice Guidelines 2010)

‹ Maximum Tolerable Period of Disruption

‹ Of Products and Services => of business activities => of support services
‹ Provides the required timescales that have to be
achieved by our recovery strategies and plans
Successful recovery

Limited recovery

Failure

RTO MTPD Time

BIA is about: Services & Activities, Impacts and TIME
 When do we do a BIA?
‹ AS/NZS 5050:2010 "Detailed risk analysis….” NO!
‹ Risk analysis assumptions do not hold for BC events
‹ Risk analysis should not limit the scope of BIA
‹ Successful Business Recovery after an incident
depends on the speed of the resumption of delivery of
services not the cause of the incident
‹ Prevention is better than cure – but is costly –
controlled failure may be more cost-effective

BIA must come first – before threats, strategies and plans

How do we measure of disruption cost?
‹ Impacts grow over time and:
‹ Are Cumulative

‹ Some are intangible

MTPD is approximate – but so are strategies

 An annual update of the BIA?

Work towards BIA as a process rather than an annual project

Why do a BIA?
‹ Ensures recovery plans meet customer’s service
(minimum) expectations
‹ Delivers effective plans
‹ Can save money!
‹ A forward-looking BIA can identify opportunities (or
dangers) of proposed changes
‹ Builds resilience over time
‹ Understanding the business may lead to operational
improvements and threat reductions

A thorough BIA should repay the effort many times over

 To BIA
BCM Key points or not
to BIA?
A BIA:
•Identifies impacts over time Ian Charters FBCI
•finds the point of no return ianc@continuity.co.uk
•is not an annual chore www.continuity.co.uk
•… but a vital business tool for:
• Effective recovery plans
• Business planning