How can Federal Continuity Directives 1 and 2 help organizations conduct a business impact assessment?
With some limitations, Federal Continuity Directive 2 can be used to help develop an understanding of the criticality-rating process for business functions. More specifically, Worksheet 2 of the Mission Essential Function (MEF) identification workbook in Appendix A offers a 1 to 10 criticality rating scale that is similar to what is found in business impact assessment spreadsheet tools used in the private sector. The criticality rating descriptions will vary based on a company's field of activity but can be used as a foundation. What is called the MEF BPA Worksheet can also be useful as it relates to the identification of interdependencies between functions, staff and technology.
Federal Continuity Directive 1 is more comprehensive but geared mostly for risk assessment, mitigation strategy and continuity planning in general. It does, however, highlight the tight relationship between risk assessment and impact assessment.
That said, these documents can provide some measure of guidance for the execution of a BIA, but they are specifically written to address continuity of government and, as a result, the profuse use of government specific acronyms can quickly distract readers. A recommendation would be for businesses to not rely solely on these documents and use other business continuity industry references for guidance.
This was first published in October 2012