Disaster Recovery Journal Winter 2023

questions or concerns with them and make adjustments as necessary. Phase 4: Presenting Your Findings o Document the BIA process and results in a management report. Although some senior management teams may ask only for the less detailed presentation document (see the next step), it’s important to have a document which includes the results of your BIA in full, along with supporting details and additional findings. o Create an accompanying management presentation. This downsized version of the report succinctly conveys what the BIA was about, the results you found, and your recommendations on what to do next. o Get management approval. Gather and incorporate any final revisions to the report based on management’s review and get approval on the results of the BIA via email or a handwritten note. One Final Step If you’ve reached this stage, your BIA is complete. One final step not included in this checklist is to use the BIA to implement targeted recovery strategies which will ensure the survival of your critical business units in the event of a disruption. Once that is accomplished, you will have succeeded in your mission of providing the best pos sible protection for your enterprise. Takeaways n Use a checklist to make sure your BIAs are focused, comprehensive, and well grounded. n A checklist can be leveraged in many ways. n Your checklist should cover all four phases of the BIA: information gathering and BIA validation, conducting BIA interviews, validating the interview data, and presenting your findings. v Michael Herrera is the CEO of MHA Consulting, a leading business continu ity planning and information technology consulting firm. Herrera is the founder of BCMMetrics, which specializes in business continuity software designed to aid organizations in devel oping and executing business continuity programs.

o Schedule the BIA interviews. Work with your business unit and IT SMEs to coordinate timeframes and schedules. o Finalize the interview logistics. This may include arranging access to a conference room and/or online meeting software. o Schedule and conduct a kickoff meeting. This step is optional, though in some cases it’s useful to gather the team in advance, to give your interviewees a preview of what to expect. Phase 2: Conducting BIA Interviews o Conduct the BIA interviews. These will be based on your questionnaires. In-person interviews are preferable to virtual ones because they are more likely to encourage discussion and careful consideration of answers. Each business-unit interview should take 2.5 hours or less and be led by an experienced facilitator. First, identify all departmental business processes. Then, for each process, identify:

u Recovery time objectives (RTOs). u Recovery point objectives (RPOs). u Supporting computer systems, applications, and equipment. u Legal and regulatory requirements. u External and internal dependencies. u Vital records. u Manual workarounds. u Service level agreements, and legal and contractual requirements. Phase 3: Validating the Interview Data o Review all business-unit interview results for anomalies and missing data. If a particular business-unit criticality ranking or RTO doesn’t seem to make sense, review the results with the group and reassess. Be stringent! This is important if you expect management to take the results seriously. o Send each completed BIA questionnaire back to the business units for validation. Ask the relevant parties to review and return it with their approval. Discuss any

22 DISASTER RECOVERY JOURNAL | WINTER 2023