Business Continuity Management
BCM & BIA
Impact Analysis – Determination of the risk acceptance level
An impact analysis can be carried out for each process recorded in QSEC according to the impact category (financial, image, legal, etc.). The time period for the impact assessment (maximum process downtime by hours/days) is evaluated for all processes by the process owner. Not only the downtime of the processes is evaluated, but also the availability of employees with workstation details and any required service providers. The scaling depends on the typical damage patterns of the business processes in the industry of the considered company.
Based on the information provided by the process owner, the assets (infrastructure, IT systems etc.) can be subjected to a GAP analysis (ACTUAL/SOLL RTO/RPO).
The QSEC BCM function is used to describe the specifications of the business processes and assets for emergency planning and emergency testing with the associated emergency documentation.
QSEC®: Business Continuity Management – BIA process evaluation
- Display of the processes for BIA evaluation
- Entry of the specifications for MTPD, RTO, RPO etc.
- Evaluation of the business processes regarding the time effects of RTO, RPO for the criteria financial, reputation, control, legal (individually adjustable
- Evaluation of business processes with regard to time effects for number of employees, workstation requirements, service providers
- Calculation of the process criticality
- Presentation of the GAP analysis (target/actual RTO; RPO) and creation of measures for each asset group
- Definition of contingency planning and emergency tests for critical business processes
- Review and evaluation of the documentation for critical asset groups (IT contingency plan, operating manual, restart plan) with all test results that have been carried out (individually adjustable)
QSEC® GRC can implement and manage compliance, IT risk, security incident and business continuity management in one single system.