Business Impact Analysis Marc Scarborough Information Security Officer Rice University marcs@rice.edu

Agenda Business Impact Analysis (BIA) Walk Through a Basic Template Example General Notes Questions Links

Why BIA? From NIST (your tax dollars at work): “The purpose of the BIA is to identify and prioritize system components by correlating them to the mission/business process(es) the system supports, and using this information to characterize the impact on the process(es) if the system were unavailable.”

Why BIA? Inventory Documentation Prioritization When is the last time you had a good inventory of the systems performing your mission critical work? Documentation In an emergency situation do people know what to do? Prioritization Knowing what is integral in supporting critical University functions and its mission before something happens is good to know.

Example BIA Template Service Description Outage Impact Maximum Tolerable Downtime Recovery Time Objectives Resource Requirements Recovery Priorities for System Resources

Service Description A primary focus of the BIA is to identify systems that support services critical to the University. The Service Description should include as much information as is not available elsewhere. As documentation for services progresses, pointers to existing, more often updated information might be more appropriate, if it contains the right information.

Service Description Description of what the service provides Hardware and software Customers potentially impacted, both internal and external, due to outages Contact information as well Systems and services that depend on it Systems and services that it depends on Vendor and support contact information

Outage Impact Which services should receive priority during or after an emergency should be determined by how much (and how quickly) that service impacts operations within the University

Outage Impact When a service goes offline, how does it impact operations in the University? How long until operations are impacted? How long until operations are halted? Maximum Tolerable Downtime (MTD) How long will it take to recover? Recovery Time Objectives (RTO) Many IT services support several University operations Outage impact should be analyzed for each

Maximum Tolerable Downtime MTD This is represented as the absolute maximum time that can be tolerated for a University operation to be stopped. For example, how long can the University go without the ability to pay for services? Each operation the service facilitates should have this information.

Recovery Time Objectives RTO This is represented as the time a system (not an operation) is unavailable before potentially affecting other systems. For example, how long can DNS stay down before Email goes down, affecting University business? This should be smaller than the MTD, and include time to restore information or re-run processes (like tape restores), all within the MTD window.

Resource Requirements The systems, hardware and software that support the service should be listed here. This might contain items from the Service Description section as well as specific dependencies.

Recovery Priorities Which systems and resources should be restored to service first? Now that the critical University operations, impacts to the campus, tolerable downtimes and service components have been identified, prioritize the recovery steps by system and resource.

Example - Sakai Service Description

Example - Sakai Outage Impact

Example - Sakai Maximum Tolerable Downtime and Recovery Time Objective

Example - Sakai Resource Requirements

Example - Sakai Recovery Priorities for System Resources

General Notes Its late in the day... Remember what the BIA is designed to help you do: Identify and prioritize Help with both continuity and recovery planning The template I use is based on NIST guidelines, but each University will most likely need to create or modify one that works for them. Thank you

Questions?

Links NIST http://csrc.nist.gov/publications/nistpubs/800- 34-rev1/sp800-34-rev1.pdf