Question

A risk practitioner is conducting a business impact analysis (BIA) for an order-processing application. Business owners assert the system is 'mission critical,' but they cannot agree on how severe an outage would be. To produce a defensible prioritization that the steering committee can use to allocate recovery investment, what should the practitioner do FIRST?

Accepted Answer

Quantify the impact of disruption over time by measuring lost revenue, operational costs, and other consequences at defined outage intervals

Answer

Assign a qualitative 'high/medium/low' criticality rating to each business process based on owner opinion

Answer

Define recovery time objectives (RTOs) and recovery point objectives (RPOs) for the application

Answer

Select and implement redundant infrastructure to minimize the likelihood of an outage