Operation
8.2.2
Business impact analysis
Use the impact analysis to set continuity priorities and requirements: settle which types of impact matter in the organization's context and the criteria for judging them; identify the activities that support delivery of products and services; assess how the impact of disrupting those activities grows over time; fix the point beyond which failing to resume would be unacceptable; within that point, set prioritized time frames for resuming the activities at a stated minimum capacity that is still acceptable; identify the prioritized activities; and establish the resources, dependencies and interdependencies they need, partners and suppliers included.
What the baseline asks
Use the impact analysis to set continuity priorities and requirements: settle which types of impact matter in the organization's context and the criteria for judging them; identify the activities that support delivery of products and services; assess how the impact of disrupting those activities grows over time; fix the point beyond which failing to resume would be unacceptable; within that point, set prioritized time frames for resuming the activities at a stated minimum capacity that is still acceptable; identify the prioritized activities; and establish the resources, dependencies and interdependencies they need, partners and suppliers included.
What it means when the service runs in the cloud
The impact analysis should state, for each critical activity, how long it can stop and what it would cost, then compare that with the provider's recovery commitment. Where the commitment is longer than the tolerance, you have a gap whether or not the contract is compliant.
Evidence an auditor or a customer asks for
- Defined impact types and criteria approved for this organization
- Activity inventory mapped to products and services
- Impact over time analysis per activity
- Maximum tolerable period of disruption and resumption time frames with minimum acceptable capacity, approved by management
- Prioritized activity list with resource, dependency and interdependency mapping
Common gaps in a cloud estate
- Recovery time frames set by aspiration and never reconciled to the impact analysis that should produce them
- Minimum acceptable capacity omitted, so a plan can claim recovery at any level of service
- Dependencies mapped one level deep, missing the supplier behind the supplier
- Impact criteria copied from a template rather than defined for this organization's context
Done well, what the file shows
Done well, this clause leaves a defined impact types and criteria approved for this organization that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Put the provider recovery commitment beside the activity's tolerance and mark the gap.