Day 68 of 100 Days of Cybersecurity - Business Impact Analysis

Some of my previous days (risk management, cybersecurity insurance, and business continuity) have related closely to the topic of a business impact analysis (BIA). A BIA is both a process and a document. If done well, the process is a comprehensive examination of how the business in question would be affected by a particular event. The details of this process are used to create a report.

A well-written BIA covers not just cybersecurity events, but all categories of events that could influence the business, in positive or negative ways. It is impossible to list every single possible event so categories of the most likely and most impactful events should be considered. A BIA should include things like how to handle a sudden spike in business. If a business does not have a plan for this, it can become overwhelmed by the traffic and fail to deliver, effectively death by success. A BIA must be specific for each business and the environment in which it lives. For example, a business that operates on a beach town that has a four month tourist season needs to plan for how the business will be impacted by that and how it will need to function differently because of it. A business that is located in an area that gets lots of snow has to plan on how to function during blizzard conditions.

On the cybersecurity side of the business, there needs to be consideration of as many possible issues as possible. A plan needs to be in place for if there is a ransomware attack. The business should decide in advance how it will respond to the ransom demand. There should be a plan for how to handle a malware outbreak. What will be the response if all the business devices are compromised? After it happens it is not that time to figure it out.

Business owners are not expected to be cyber experts. However, some level of cyber knowledge is needed to help with BIA evaluation and planning. This is where resources like small business development centers, business incubators, and business networking groups come in handy. There is no need for business owners to run themselves crazy trying to figure all of this out. Use the resources that are available and in many cases free. Some helpful links are listed for anyone looking to learn more about this.

Link to a BIA template in Word:

https://csrc.nist.gov/CSRC/media/Publications/sp/800-34/rev-1/final/documents/sp800-34-rev1_bia_template.docx

Useful resources:

https://www.ready.gov/business-impact-analysis

https://www.g2.com/articles/business-impact-analysis

#100daysofcyberchallenge

#cybertechdave100daysofcyberchallenge

#cybersecurityineasypieces