ISC2 Certified in Cybersecurity (CC)Business Continuity (BC), Disaster Recovery (DR) & Incident Response (IR) ConceptsMedium
An organization is conducting a comprehensive review of its critical business functions to understand the potential impact of disruptions. They are analyzing the financial, reputational, and operational consequences of various outages. What type of analysis are they performing?
- ARisk Assessment
- BBusiness Impact Analysis (BIA)
- CVulnerability Assessment
- DPenetration Test
Show answer & explanationAnswer & explanation
Correct answer: B. Business Impact Analysis (BIA)
A Business Impact Analysis (BIA) systematically identifies and evaluates the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency, focusing on financial, operational, and reputational impacts.
Why the other options are wrong
- A. Risk assessment identifies risks and their likelihood/impact, but BIA specifically focuses on the impact of disruption to business functions.
- C. Vulnerability assessment identifies weaknesses in systems, not the business impact of outages.
- D. Penetration testing simulates attacks to find vulnerabilities, which is not focused on business impact of outages.
Business Impact Analysis (BIA)
A systematic process to determine and evaluate the potential effects of an interruption to critical business operations as a result of a disaster, accident, or emergency.
- Identifies critical business functions
- Quantifies financial, operational, and reputational impacts
- Helps define RTO, RPO, and MTD
Memory trick: BIA: Business Impact Analysis, what's the Business Impact if things go Away?