How can Federal Continuity Directives 1 and 2 help organizations conduct a business impact assessment?
With some limitations, Federal Continuity Directive 2 can be used to help develop an understanding of the criticality-rating process for business functions. More specifically, Worksheet 2 of the Mission Essential Function (MEF) identification workbook in Appendix A offers a 1 to 10 criticality rating scale that is similar to what is found in business impact assessment spreadsheet tools used in the private sector. The criticality rating descriptions will vary based on a company's field of activity but can be used as a foundation. What is called the MEF BPA Worksheet can also be useful as it relates to the identification of interdependencies between functions, staff and technology.
Federal Continuity Directive 1 is more comprehensive but geared mostly for risk assessment, mitigation strategy and continuity planning in general. It does, however, highlight the tight relationship between risk assessment and impact assessment.
That said, these documents can provide some measure of guidance for the execution of a BIA, but they are specifically written to address continuity of government and, as a result, the profuse use of government specific acronyms can quickly distract readers. A recommendation would be for businesses to not rely solely on these documents and use other business continuity industry references for guidance.
Dig Deeper on Disaster recovery planning - management
Related Q&A from Pierre Dorion
Find out what business impact assessment errors you can most easily identify in this Expert Response from Pierre Dorion. Continue Reading
Pierre Dorion highlights some of the business impact analysis tools available to help companies in this Expert Response. Continue Reading
In this Expert Response, Pierre Dorion highlights some of the issues involved in protecting an organization from a supply chain disruption. Continue Reading