ISMS: Perform a business impact analysis and understand the MTPD

With the business impact analysis (BIA), you define how long a business process can be down before it becomes unacceptable for your organization. The ISMS module uses it to calculate the MTPD (maximum tolerable period of disruption) and automatically passes the availability requirement on to every asset the process depends on. This shows you which systems really need to be back up quickly.

Prerequisites

• The business process exists in the ISMS module.
• You are allowed to manage the process: you are its Owner or you have the Key User or Admin role.

What you assess in the BIA

The BIA is a matrix of scenarios and time periods. For each combination, you choose a level on the impact scale. The guiding question is: "How painful is it if this process fails, and from when on?"

Three scenarios are set up by default. Each looks at an outage from a different angle:

Task fulfilment and service capability

The operational view

Scenario 1

How severely does an outage affect key tasks, services, deadlines or operational control?

Protection duties and compliance

The legal view

Scenario 2

What are the consequences for legal, contractual or regulatory obligations, data protection or the safety of people?

Economic and external impact

The financial view

Scenario 3

What financial damage, follow-up costs, contractual penalties or loss of trust and reputation result?

The default time periods are 8 hours, 24 hours, 72 hours and 14 days. You assess using the impact scale, which has five levels by default:

Perform the BIA for a process

1. Open Business processes and select the process.
2. In the sidebar, click the pencil icon next to Business impact (BIA). The Business impact analysis dialog opens.
3. Choose a level for each scenario and time period. If you cannot assess a cell yet, leave it at Not assessed.
4. Use Rationale (optional) to record why you rated it this way. This makes your assessment traceable in an audit.
5. Click Finalize assessment.

While you assess, the dialog header already shows the resulting MTPD and the Max impact.

When does a BIA count as done?

As soon as at least one cell is assessed. You can spot processes without a BIA by the BIA pending badge in the list, and they appear under Action required on the dashboard. If you set all cells back to Not assessed, the BIA is reset.

Understand the MTPD

The MTPD is the period from which an outage is no longer acceptable. The ISMS module determines it using the intolerance level: the MTPD is the first time period in which any scenario reaches this level. By default, the intolerance level is Severe.

If no scenario reaches the intolerance level, the ISMS module shows the MTPD as "greater than or equal to" the longest period, for example MTPD ≥ 14 days.

The sidebar of the process shows the BIA as a compact chart. Scenarios are abbreviated there, and a red dashed line marks the MTPD.

What the BIA means for your assets

The BIA produces the process's availability curve: the highest impact per time period across all scenarios. The ISMS module passes this curve on via the dependencies to the assets the process uses. So you don't have to estimate the availability of each system separately, it follows from the business.

Tips for a robust BIA

• Have the BIA done by the person who really knows the process, for example the head of sales for "Create quotation".
• Think in concrete consequences: missed deadlines, contractual penalties, reporting obligations. This helps you choose the level.
• Use the rationale. In an audit, it lets you show why a system has to be back up within 24 hours.

Related articles

• ISMS: Create business processes and link information
• ISMS: Create assets, maintain dependencies and derive required protection
• ISMS: Dashboards: keep track of pending actions and the risk landscape
• ISMS: Settings, default values and data import