CISSP 3.3 - Business Impact Analysis

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series reaches the heart of the business continuity work in Domain 1 — how organizations decide, with evidence instead of gut feeling, which business processes deserve their limited resilience resources, and how numbers and human judgment combine into a single defensible ranking.

Frequently Asked Questions

What is a business impact analysis, and how do the quantitative and qualitative views differ?

A business impact analysis is the study that identifies which processes are critical to your survival, what threatens them, how likely those threats are, and what impact they would cause. A quantitative assessment uses numbers and formulas, usually expressing options as dollar values, while a qualitative assessment weighs the things numbers miss, like reputation, customer confidence, and workforce morale, sorting them into bands like high, medium, and low. It mirrors ordinary risk assessment with one twist: risk work centers on individual assets, while this work centers on whole business processes.

What are the five stages of a business impact analysis?

The work unfolds in a clear sequence. First, identifying priorities, where you rank your critical business functions. Second, risk identification, where you list the threats those functions face. Third, likelihood assessment, where you estimate how often each threat strikes. Fourth, impact analysis, where you measure the damage each threat would cause, and fifth, resource prioritization, where you sort everything into a single ordered list for action.

What are the timing metrics that guide recovery?

The maximum tolerable downtime is the longest a function can be down before the harm becomes irreparable, and critical functions carry a shorter one than routine functions. The recovery time objective is how quickly you believe you can actually restore a function, and it must always sit below the maximum tolerable downtime. The recovery point objective is the data-loss counterpart: the amount of data you can afford to lose, measured backward from the moment of the incident — if you back up transaction logs every 15 minutes, your recovery point objective is 15 minutes.

How do you measure the impact of each risk in dollars?

Through three linked quantitative metrics. The exposure factor is the share of an asset’s value that a risk would destroy, written as a percentage. The single loss expectancy is the money lost each time the risk hits, calculated by multiplying asset value by exposure factor — a building worth $500,000 with a 70% exposure factor gives a single loss expectancy of $350,000. The annualized loss expectancy multiplies the single loss expectancy by the annualized rate of occurrence, and alongside the math you must weigh nonmonetary damage like lost goodwill, departing employees, and bad publicity.

How do you turn all of this into a priority list?

On the quantitative side it is simple: list every risk, sort it in descending order by annualized loss expectancy, then work down from the top until you exhaust your resources. Then you fold in the qualitative concerns, an exercise that is more art than science, sitting with senior management to raise or lower a risk’s rank based on judgment the numbers miss. A fire suppression company, for instance, might elevate fire above an earthquake that would cause more physical damage, because being destroyed by the very thing it sells against would shatter its reputation.

Reference: This article is based on concepts discussed in CISSP 3.3 - Business Impact Analysis.