[Music] hey everyone it's justin thank you for watching in this video we're going to continue talking about business continuity management and specifically we're going to focus today on business impact analysis okay so this is the beginning step when you're doing business continuity management you want to and analyze the impact if something will happen to a process an application a piece of technology a location a department what is the impact and what is that going to how is it going to affect your organization so let's not talk about it too much let's get to showing it i'm going to use this start bia action up here at the top to kind of show exactly you know walking through a particular plan and when we start that we just give it a name so we're just going to call this demo for the world and when you're doing business impact analysis you get to set up templates okay and so the templates that you can see here these are demo templates i'm going to do an application technical impact assessment because that's where i have some demo data i have some impact categories and some ratings and all of the kind of time frames associated with it but you might do something different for a business capability than you might for an application or a business service or a data center right you might want to assess the impact of something happening to a data center so let's choose application technical impact i'm going to pick it for my business unit and my department just to keep things simple that's my background and then for this one i'm going to look at the customer portal okay so customer portal is obviously a critical application that we want to make sure is always working right so if it's not working we may lose revenue we may have customer dissatisfaction and so we want to assess those kind of things this is what a business impact analysis looks like in the draft state so notice i don't have any rpo or rto or recovery tier yet associated with this now the work in this comes down here below i'm going to hide this menu item on top so we can see in this application technical template that i just picked it comes with legal impact reputation revenue workforce so four different categories of impact for us to evaluate and i want to walk you through one of them because it would be boring for me to fill out all of this stuff but notice that i have an impact rating and a description so my impact rating low moderate high it's asking me okay if there's if it's low and there's no breach of contract as a result of the disruption what do you want to be the duration of that do you need it immediately is it okay if it's eight hours 24 hours 72 hours so what we're building here is the recovery time objective okay so how long do we anticipate in a low impact situation the recovery time is it going to be eight hours or we do need we need it immediately okay so if it's probably if it's low let me just double click in here if it's low probably 24 hours is probably sufficient right so i'll just double click here and we'll do 24 hours if it's moderate it would result in limited breaches of contract okay we need it faster right so we've got to recover faster so let's do eight hours and if it would result in widespread contractual violations resulting in individual or class action lawsuits okay that's a big deal then it may be immediate we need to immediately the recovery time objective to be there right so that's how you're framing this that's how you're entering this and recovery time is the amount of time to bring things back to where they should be now in impact analysis you make that complete you go onto the next one you fill all these out right so um on this particular interface you can expand this if there's lots of questions and stuff like that and get a fully focused kind of interface there the next piece i want to show is rpo so recovery point objective let's talk about the difference there though recovery time objective how long before we recover recovery point objective is what point are we recovering to within that time frame so i chose in that previous example let's click on it again here before i go to the recovery point objective for the low impact 24 hours to recover to what point eight hours to recover to what points and immediately to recover to a point a lot of that's going to be driven by and especially in an application space is what are your backups like are they every hour are they every 15 minutes are they every 24 hours and that's going to drive a lot of this and as you do this assessment you may decide that hey we need to increase our impact so i put this demo data in here for rpo and said what is the maximum acceptable amount of data lost and then you get to select in my example a duration of time so if i double click here i can do 15 30 minutes an hour four hours or eight hours and what i'm saying is that it's acceptable for this application for me to have one hour of data loss that means that one hour i'm going to have to probably re-enter that data or lose that data once the system's recovered now if it's really critical like we were seeing there on some other values i may say hey i can only tolerate 15 minutes because we do you know thousands of transactions per minute or if it's something that's barely ever used maybe eight hours is sufficient and i can have bob over in the back office go hand entered back in the details right it all just depends on the application in your situation so that's rto that's rpo two critical concepts when it comes to the business impact analysis the last piece here and this again is related to this application technical template that i selected is what are their dependencies okay so who am i dependent on for this application to recover what hardware what vendors what is there a data center that i'm dependent on so if i open one of these and get rid of my highlighting i can say hey i want to add a new hardware item and i'm going to say this such this rack houses my customer portal and i'm going to add that and i can put in a description and put in the the required recovery time frame and the required uh i gotta hover over here because i can't remember what they're called the required data backup right so these are gonna recover these are gonna drive rto and rpo at a global level at a high level based on these dependencies so when i come in here and fill these out i can put a description in super awesome or just call this awesome hardware rack and then we'll say for the recovery required time that rack takes 15 minutes to recover and it's going to be immediately right it's so there's no data involved in a hardware rack and so i can um like i showed you in the previous one i can make this bigger i can come in and adjust these columns so that i can actually read it so that's the kind of interface there if you're the business continuity manager or a stakeholder who's coming in to look at all this stuff and now i know when i'm looking at this particular impact analysis that i am dependent on this rack and how long that rack takes to recover and if i was to go and do these rpos and rtos i might look at these dependencies to drive that value last piece we'll leave you with here the details this is was uh this piece over here was all entered when i created it so i just highlight that here this all when i was creating the template i kind of created that i could put a bcm lead and a further description for this particular impact analysis but i don't have one there and if i scroll down as i complete this impact analysis i would see all the results of it right so the confidentiality is a flag we can set um within bcm and the availability low medium critical integrity low medium critical and oh by the way i should highlight that as rto and rpo get established as the person who's completing this program manager or the planner they can come in and adjust rto and rpo right so it makes system a calculated value based on all the questions we entered but you can come in and adjust those things now after you do your impact analysis and you understand what the recovery time objectives and what the recovery point objectives are and all the dependencies associated with them the next step in business continuity management is to put together a plan and then uh that'll be the next video following on this one and what we do with the plan is we might do exercises or execute the plan in the event that something unfortunate happens i hope you found this video helpful if you did please like please subscribe or share with somebody who you think might be interested in business continuity management and until next time don't forget to always be learning [Music] you