More Than Just Recovery Time Objectives

Catalyst-Business-Continuity-Software-Dependency-MappingUsing the Business Impact Analysis to Understand Relationships Between Resources and the Business

BACKGROUND
The business impact analysis (BIA) establishes the foundation of an organization’s business continuity program by establishing business continuity requirements. As a result, a significant part of Avalution’s work involves helping organizations design and execute the BIA process. Furthermore, a well-executed BIA can deliver so much more than just a list of recovery time objectives (RTOs) and recovery point objectives (RPOs)!

One of the ways Avalution adds value as part of the BIA process is by illustrating or “mapping” the relationships between products and services, business activities, and resources. By doing so, we can better understand the business use of specific resources and understand how unavailability impacts the business as a whole. This BIA task is extremely valuable when working with business continuity planning stakeholders, such as an application manager, to plan for and mitigate the risks associated with a disruptive incident. Should a disruptive incident occur, this work also enables our clients to quickly understand the implications of the incident, based on resource loss scenarios.

Note: in this context, resources include people, technology, facilities, equipment, and third-parties.

As an example, let’s look at a fire that impacts an organization’s offices in Denver. The ability to understand which areas of the business rely on those offices (and ultimately which products and services are impacted) within seconds or minutes can be instrumental in responding effectively and understanding the potential impacts of the disruptive incident. This information is readily accessible if you map dependencies during the BIA! Before the fire even occurred, this same organization could have used the relational data to work with executives, facility management, and business representatives to assist in proactively planning for a facility outage by identifying alternate work locations.

Catalyst Business Continuity Software Dependency Mapping 1

An illustration mapping Denver’s relationship with different areas of the business. This information can also be displayed in charts or tables.

MAPPING DEPENDENCIES DURING THE BIA
Defining relationships during the BIA is fairly straightforward – presenting the data in an easily accessible and cohesive format can, however, be challenging (more on that later). To map resource dependencies, an organization needs to:

  1. Develop a method for linking the activities performed by each area of the business to the resources required to deliver those activities;
  2. Connect each activity to its corresponding products and services; and finally
  3. Identify interdependencies between the different areas business (for example, Accounts Payable often has a dependency on Treasury to execute transactions).

Catalyst Business Continuity Software Dependency Mapping 2

Example of connecting an activity to a product and service

Catalyst Business Continuity Software Dependency Mapping 3

Example of connecting a resource (in this case, an application) to an activity

Mapping data in this manner enables an organization to understand exactly which activities and resources are required to deliver a specific product and service (and as a result, how downtime would impact product and service delivery). By mapping interdependencies, an organization also can look at relationships across the business. Take our example above. Treasury executes transactions on behalf of Accounts Payable. Therefore, if Treasury’s payment system is unavailable, we know that Accounts Payable is also impacted and can proactively implement recovery strategies.

Catalyst Business Continuity Software Dependency Mapping 4Catalyst Business Continuity Software Dependency Mapping 5

Mapping data showing relationships between departments and departments and applications

Organizations can perform this type of mapping using Microsoft Access, Excel, or even Word; however, accessing specific data sets in this format can be challenging to both create and maintain. To provide this functionality using only Microsoft Office products is time intensive and requires a skilled user who can build a relational database from scratch. While this is certainly feasible, Avalution (and many other organizations) are using tools, such as Catalyst business continuity software, to map dependencies. A tool like Catalyst not only automates the mapping process, but also provides the ability to access specific data sets and view illustrations right out of the box!

CONCLUSION
Performing a BIA is a time investment. As such, organizations should seek to obtain the maximum possible return on their investment!

One way to add value as part of the BIA process is by mapping dependencies to understand relationships between resources and the business, and ultimately, each resource’s impact upon product and service delivery. This work not only assists with risk mitigation and business continuity planning, but can contribute to the incident management process and other related disciplines. Finally, with the assistance of software, performing mapping dependencies requires only a small additional time investment.

For more information about relationship mapping in Catalyst or Avalution’s business impact analysis process, please don’t hesitate to reach out to us and request a free demonstration.

If you would like to connect regarding business continuity or BIA best practices, you can learn more about us and start a conversation at avalution.com.

_______________________

Dustin Mackie
Avalution Consulting: Business Continuity Consulting


Leave a Reply