Identify & analyze & prioritize BC requirements

Objectives:

At the end of this episode, I will be able to:

Understand and apply the recommended guidance to identify, analyze & prioritize
Business Continuity (BC) requirements through your daily practice as an
information security professional.

External Resources:

Identify, analyze, and prioritize Business Continuity (BC) requirements

1. Develop and document scope and plan

Project Management
Senior Management Support (*)
Project Scope
Resources
Timeline

2. Business Impact Analysis (BIA)

Used to determine what impact a disruptive event would have on an organization

Goals:

1. Determine Criticality
2. Estimate Maximum Downtime
3. Evaluate Internal and External Resource Requirements

Process Steps:

1. Gather requirements/information
2. Vulnerability assessment
3. Risk Analysis
Quantitative - ALE = SLE * ARO ===> ALE = (AV*EF) * ARO
Qualitative
4. Communicate findings - Audience relevancy

Determining Downtime:

Maximum Allowable Downtime (MAD) / Maximum Tolerable Downtime (MTD)

Recovery Time Objective (RTO)

Work Recovery Time (WRT)

Recovery Point Objective (RPO)