What is it ?
• Summary of service loss impact for each application in terms of:
o Loss of revenue, prestige or market share
o Loss of legal compliance
o Loss of input to, or processing from, other applications
• A definition of how important each IT application is to the business
o High Importance – must have a fast recovery plan (hours)
o Medium Importance - should have a recovery plan (days)
o Low Importance – could have a recovery plan (weeks)
• A statement of the required recovery performance
o Recovery Time Objective (RTO)
o Recovery Point Objective (RPO)
o Dependency on the recovery of other applications
How does it work ?
• For each application determine the impact of service loss
• Use business related input first then technical verification
• For each application agree an Importance level and an RTO/RPO
Blunder points ?
• Budget – the faster the recovery the more it will cost
• Geek – the Business may not understand the Technology
• Box Ticking – experienced BIA staff must guide and drive the Analysis
What next ?