1.0 Purpose

The purpose of the Business Impact Analysis (BIA) is to identify and prioritize system components by correlating them to the business process(es) the system supports, and using this information to characterize the impact on the process(es) if the system were unavailable.

The BIA is composed of the following three steps:

• Determine business processes and recovery criticality. Business processes supported by the system are identified and the impact of a system disruption to those processes is determined along with outage impacts and estimated downtime. The downtime should reflect the maximum that an organization can tolerate while still maintaining the mission.
• Identify resource requirements. Realistic recovery efforts require a thorough evaluation of the resources required to resume business processes and related interdependencies as quickly as possible. Examples of resources that should be identified include facilities, personnel, equipment, software, data files, system components, and vital records.
• Identify recovery priorities for system resources. Based upon the results from the previous activities, system resources can more clearly be linked to critical business processes. Priority levels can be established for sequencing recovery activities and resources.

2.0 Overview

This BIA policy was developed as part of the contingency planning process for FinGoal.  It was prepared on 06-01-2020.

This document is used to build the FinGoal Business Continuity Plan and is included as a key component of that plan.  It also may be used to support the development of other contingency plans associated with the system, including, but not limited to, the Disaster Recovery Plan or Data Breach Response Plan.

3.0 Scope

The scope of this plan covers FinGoal. The plan is applicable once the life safety of employees, customers, and guests has been verified and in the event that a facility is or will become inaccessible. It can be active during normal business hours and after hours, with and without warning.

4.0 Procedure

The following process should be followed by each member of the FinGoal leadership team on a periodic basis. Members of the team will meet and synthesize the findings of their respective BIAs in order to incorporate them into the Business Continuity Plan.

4.1 System Description

Provide a general description of system architecture and functionality.  Indicate the operating environment, physical location, general location of users, and partnerships with external organizations/systems.

Include information regarding any other technical considerations that are important for recovery purposes, such as backup procedures.  Provide a diagram of the architecture, including inputs and outputs and telecommunications connections.

4.2 Determine Process and System Criticality

Working with input from developers, product managers, and leadership team members, identify all essential FinGoal services which depend on or support the systems described in the previous steps. Refer to the list of FinGoal’s essential services to determine which systems govern which key FinGoal services..

If criticality of business processes has not been determined outside of the BIA, the following subsections will help to determine criticality of business processes that depend on or support the information system.

Identify Outage Impacts and Estimated Downtime