Certified Information Security Manager (CISM)Incident ManagementMedium
A healthcare organization is conducting a business impact analysis (BIA) as part of its business continuity planning. During the BIA, several critical business processes are identified, each supported by multiple IT systems. The CISO needs to prioritize recovery efforts for these systems. Which of the following factors should be the PRIMARY consideration when assigning recovery priorities to IT systems based on BIA results?
- AThe number of users who rely on the IT system daily.
- BThe cost of replacing or rebuilding the IT system.
- CThe age and complexity of the IT system's architecture.
- DThe system's role in supporting critical business functions and its impact on MTD.
Show answer & explanationAnswer & explanation
Correct answer: D. The system's role in supporting critical business functions and its impact on MTD.
The primary purpose of a BIA is to understand the impact of disruptions on business functions. Therefore, prioritizing IT systems for recovery must align with their criticality to business functions and how their unavailability affects the Maximum Tolerable Downtime (MTD) of those functions.
Why the other options are wrong
- A. While user count indicates usage, it doesn't necessarily reflect the criticality of the business function supported or its impact on the organization's MTD.
- B. Cost of replacement is a factor in recovery budgeting but does not directly determine the business criticality or recovery priority.
- C. Age and complexity can affect recovery time but are not the primary drivers for business-level prioritization from a BIA.
Business Impact Analysis (BIA)
A systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency.
- Identifies critical business processes and their dependencies.
- Determines RTOs and RPOs for systems and data.
- Quantifies financial and non-financial impacts of disruptions.
Memory trick: BIA prioritizes by 'I.M.P.A.C.T.': Impact on MTD, Process criticality, Asset dependencies, Compliance, and Threats.