The Business Impact Analysis is used by business owners to capture the mission essential functions supported by their system, internal and external dependencies, and to document recovery metrics such as recovery time objective, recovery point objective, and maximum tolerable downtime. The BIA is part of the starter kit because it is tied closely to the FIPS-199 availability rating, and is now a required artifact of all system ATOs.

Completing the BIA

Fill in section 2 as completely as possible using the following tips and reminders

• Reference the FIPS-199, which you should have already filled out to complete section 2.4 of the BIA
• Ensure that information such as points of contact, CIO, ISSO, System Owner, in the BIA are consistent with information in other Starter Kit documents.

Section 3:

• Identify resource requirements:
  • Identify and evaluate resources required (facilities, personnel, equipment, software, data files, and system components) to resume {System Name} operations as quickly as possible. Do your best to identify equipment by at least their unique IP address, host name, etc. even if you cannot list details about specific hardware or virtual servers.
• Identify recovery priorities for system resources:
  • Based upon the results from the previous activities, identify the system resources that are linked to critical NIH missions and goals
  • Establish priority levels for sequencing recovery activities and resources

BIA Resources:

NIH Business Impact Analysis Template