BCMS-FORM-08-1 Business Impact Analysis Tool

Note: not all pages are shown in this sample.

Identification of Key Business Activities [List all the key business activities within the scope of the analysis exercise and their requirements] RESOURCES USUALLY NEEDED FOR THIS ACTIVITY TO OCCUR Ref Business activity 1 2 3 4 5 6 7 8 9 10

People

Information and data

Buildings, work Facilities, equipment environment and utilities and consumables

ICT systems

Transportation Finance

Partners and suppliers

Outcome of delivered activity

Any legal, statutory and contractual obligations

Impact of Disruption [For each key business activity, assess the impact of unavailability over time in each area. For example, customers, finance] REFERENCE: [Impact 1] Time One hour Three hours One day Three days One week One month

Impact on staff or public well-being Select…

Select…

Select…

Select…

Select…

Select…

BUSINESS ACTIVITY: [Business activity] Impact of breaching legal or regulatory requirements Select…

Select…

Select…

Select…

Select…

Select…

Damage to reputation Select…

Select…

Select…

Select…

Select…

Select…

Impact on financial viability Select…

Select…

Select…

Select…

Select…

Select…

Key: 1 (low) to 5 (high)

REFERENCE: [Impact 2] Time One hour Three hours One day Three days One week One month

Impact on staff or public well-being Select…

Select…

Select…

Select…

Select…

Select…

Time One hour Three hours One day Three days One week One month

Impact on staff or public well-being Select…

Select…

Select…

Select…

Select…

Select…

Key: 1 (low) to 5 (high)

Environmental damage Select…

Select…

Select…

Select…

Select…

Select…

Total score 0 0 0 0 0 0

COMPLETED BY: [Enter name here] DATE: [Enter date here]

BUSINESS ACTIVITY: [Business activity] Impact of breaching legal or regulatory requirements Select…

Select…

Select…

Select…

Select…

Select…

Damage to reputation Select…

Select…

Select…

Select…

Select…

Select…

Impact on financial viability Select…

Select…

Select…

Select…

Select…

Select…

Key: 1 (low) to 5 (high)

REFERENCE: [Impact 3]

Impact on product or service quality Select…

Select…

Select…

Select…

Select…

Select…

Impact on product or service quality Select…

Select…

Select…

Select…

Select…

Select…

Environmental damage Select…

Select…

Select…

Select…

Select…

Select…

Total score 0 0 0 0 0 0

COMPLETED BY: [Enter name here] DATE: [Enter date here]

BUSINESS ACTIVITY: [Business activity] Impact of breaching legal or regulatory requirements Select…

Select…

Select…

Select…

Select…

Select…

Damage to reputation Select…

Select…

Select…

Select…

Select…

Select…

Impact on financial viability Select…

Select…

Select…

Select…

Select…

Select…

Impact on product or service quality Select…

Select…

Select…

Select…

Select…

Select…

Environmental damage Select…

Select…

Select…

Select…

Select…

Select…

COMPLETED BY: [Enter name here] DATE: [Enter date here]

Total score 0 0 0 0 0 0

Key Business Continuity Targets [For each key business activity, state the MTPD, RTO, MBCO and RPO]. See panel, right, for key.

REF BUSINESS ACTIVITY 1

[Business activity]

2

[Business activity]

3

[Business activity]

4

[Business activity]

5

[Business activity]

6

[Business activity]

7

[Business activity]

8

[Business activity]

9

[Business activity]

10

[Business activity]

MTPD

RTO

MBCO

RPO

Key to terms MTPD (Maximum Tolerable Period of Disruption), when any one impact scores four or more: Time it would take for adverse impacts, which might arise as a result of not providing a product/service or performing an activity, to become unacceptable (see also MAO).

RTO (Recovery Time Objective): Period of time following an incident within which a) product or service must be resumed or b) activity must be resumed or c) resources must be recovered.

MBCO (Minimum Business Continuity Objective): Minimum level of services and/or products that is acceptable to the organization to achieve its business objectives during a disruption.

RPO (Recovery Point Objective): Point to which information used by an activity must be restored to enable the activity to operate on resumption.

Dependencies and Recovery Needs [For each key business activity list the dependencies at each time period, starting from the relevant RTO. Then calculate the total requirement across the time periods] [Note: where cells are automatically populated from other sections of the tool, make sure you expand the cells to show all of their contents.]

Total requirement REFERENCE: All

BUSINESS ACTIVITY:

All

Dependency

Normal requirement

One hour

Three hours

One day

Three days

One week

One month

People Information and data Buildings, work environment and utilities Facilities, equipment and consumables ICT systems Transportation Finance Partners and suppliers COMPLETED BY: [Enter name here] DATE: [Enter date here]

Requirements per business activity REFERENCE: [DepRec 1]

BUSINESS ACTIVITY:

[Business activity]

Dependency

Normal requirement

One hour

People Information and data Buildings, work environment and utilities Facilities, equipment and consumables ICT systems Transportation Finance Partners and suppliers

[Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement]

Three hours

One day

Three days

One week

One month

RTO: [RTO] MBCO: [MBCO]

REFERENCE: [DepRec 2]

BUSINESS ACTIVITY:

[Business activity]

Dependency

Normal requirement

One hour

People Information and data Buildings, work environment and utilities Facilities, equipment and consumables ICT systems Transportation Finance Partners and suppliers

[Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement] [Normal Requirement]

Three hours

One day

Three days

One week

RTO: [RTO] MBCO: [MBCO]

One month

Recovery Priority List [List the key business activities in order of recovery priority, together with the Recovery Time Objective and Minimum Business Continuity Objectives required] REF BUSINESS ACTIVITY 1 2 3 4 5 6 7 8 9 10

RTO

MBCO REQUIREMENTS AT RTO