Business impact and risk management model

Figure 1: Business Impact Analysis

Business impact analysis (BIA)

Once you have identified the assets of an organisation, the next activity is to undertake a business impact analysis (BIA). The purpose of the BIA is to correlate specific IT components with the critical processes that they support and based on that information, to characterise the consequences of a disruption to the components. Results from the BIA should be appropriately incorporated into the analysis and strategy development efforts for the IT Disaster Recovery Plan, Business Recovery Plans and the Incident Management Plan [NIST 800-34].

This analysis is used to estimate the impact that the loss of confidentiality, integrity or availability presents to the organisation, should the risk you have identified manifest. Risks are associated with assets, and are a function of threat, vulnerability and impact. 

In Figure 1, you can see a table showing measurement of business impact, ascending from '0' to '6' as the cost of the impact increases from '£0' to 'greater than £10 million'.

Figure 2: Risk management approach

ISO 27005 Risk management standard

This published standard describes an approach to risk management, comprised of four stages, as seen in figure 2 diagram.

It starts with Context, where information about the organisation is gathered. Then the Risk Assessment phase which includes risk identification, analysis and evaluation.

Then, after the risks have been analysed and understood, the Risk Treatment phase can begin.

You can also see that continuous monitoring and communication with stakeholders is built into the process.

As one of the key international standards, ISO 27005 is applicable to all organisations. More information can be found on the ISO website, here.

Risk appetite

Risk management doesn’t occur in a vacuum; it’s there to help the business achieve its objectives. So, the risk manager must understand the business and its priorities, together with the resources it uses and the constraints it works within.

Different organisations have different criteria for deciding how much risk they’re prepared to accept. This is known as their risk appetite.

It’s not uncommon for different business units or departments within the same organisation to have different risk appetites.

What's next?

In the next video, Mark will be introducing you to threat intelligence and the role it plays in threat management. Threat intelligence is a vital part of keeping your organisation secure.