Contributed March 15, 2001 by MarkH927@aol.com

Performing The Business Impact Analysis

1	Determine the business areas

2	For each business area, determine the business processes and identify the essential processes.

3	For the business processes, estimate the costs of failure
3.1 	What are the costs of not performing the process?
3.2 	What are the costs of performing the process late?
3.3 	What is the longest time the process could be left without being performed?

4	Determine attributes for these business processes
4.1	General
		4.1.1 	Description of process
		4.1.2 	Frequency
4.2	Establish manpower requirements
			4.2.1 	Numbers required 
			4.2.2 	Skills required 
			4.2.3 	Who normally performs the process?
		4.2.4 	Who else could perform the process?
4.3	Establish IT facilities required 1
			4.3.1 	Mainframe applications/software/data
 			4.3.2 	Mainframe hardware, terminals, printers
		4.3.3 	Server/LAN hardware/PCs/printers
			4.3.4 	LAN/PC software and data
			4.3.5	IT networks/communications
4.4	Establish non-IT facilities required
			4.4.1	Telephones, faxes
			4.4.2	Desks, chairs
			4.4.3 	Filing cabinets, storage			
			4.4.4 	Other considerations, vendors, customers
4.5	Establish clerical requirements
			4.5.1 	Forms, documents, brochures, checks, 						envelopes, etc.
			4.5.2 	Reference information, manuals
			4.5.3 	Vital/critical records
			4.5.4 	Other systems, departments' dependencies

5	For the business processes, establish the minimum resources required to operate. Prioritise essential business processes.

6	Summarise the requirements for the business processes 2
6.1	Determine the minimum acceptable backup plan (non-IT and IT facilities, clerical requirements, staff numbers and necessary skills) 
6.2	Determine the minimum acceptable recovery configuration (non-IT and IT facilities, clerical requirements, staff numbers and necessary skills) 
6.3	Are alternatives to the requirements available?
6.4	Examine time scales

7	Consider alternative backup/recovery solutions (cost/benefit analysis)
	7.1	IT
			7.1.1	Hot site
				A fully functional site ready for use
			7.1.2 	Cold site  
			A facility wired and configured to operate, 							but without the computer equipment installed
			7.1.3 	Alternative solutions	 		 	
	7.2	Workarea (office space)
			7.2.1 	Minimum/maximum module size
			7.2.2 	Increment size
			7.2.3	Types of data communications supported
			7.2.4 	Office equipment
			7.2.5 	Availability		

8	Determine the Backup and Business Recovery Strategy
A Backup and Business Recovery Strategy should be put in place based on the results of the Business Impact Analysis and the cost/benefit analysis of possible backup and recovery solutions. 

1	It may be more efficient to examine the mainframe part of IT on a global basis and not by business process 
2	It may be more efficient to examine the mainframe part of IT on a global basis and not by business process 
Annex 2