What is it ?

• Summary of service loss impact for each application in terms of:
     o Loss of revenue, prestige or market share
     o Loss of legal compliance
     o Loss of input to, or processing from, other applications

• A definition of how important each IT application is to the business
     o High Importance – must have a fast recovery plan (hours)
     o Medium Importance - should have a recovery plan (days)
     o Low Importance – could have a recovery plan (weeks)

• A statement of the required recovery performance
     o Recovery Time Objective (RTO)
     o Recovery Point Objective (RPO)
     o Dependency on the recovery of other applications

How does it work ?
• For each application determine the impact of service loss
• Use business related input first then technical verification
• For each application agree an Importance level and an RTO/RPO

Blunder points ?
• Budget – the faster the recovery the more it will cost
• Geek – the Business may not understand the Technology
• Box Ticking – experienced BIA staff must guide and drive the Analysis

What next ?
Resilient Design