4.1.3 The relevant entities shall carry out a business impact analysis to assess the potential impact of …

Requirement

The relevant entities shall carry out a business impact analysis to assess the potential impact of severe disruptions to their business operations and shall, based on the results of the business impact analysis, establish continuity requirements for the network and information systems.

Guidance

• Based on the results of the BIA (36) and risk assessment, the entity should establish appropriate recovery objectives, referred to in point 4.1.2 (f) of the Annex to the regulation (indicative, non-exhaustive list):
  • Recovery time objectives (RTOs) to determine the maximum amount of time allowed for the recovery of business resources and functions (e.g. information and communications technology (ICT) systems and processes, respectively) after a disaster occurs, for example maximum downtime of the entity’s website, enterprise resource planning (ERP) system or email system.
  • Recovery point objective (RPO) to determine how much data it is acceptable for specific ICT activities or applications to lose. Typically, they are measured in maximum time needed to recover data without causing unacceptable, according to the risk assessment, damage to the entity’s activities, for example maximum recovery time for an e-commerce website, an ERP system or an email server.
  • Service delivery objective (SDO) to determine the minimum level of performance that needs to be reached by business functions during the alternate processing mode. An indicative and non-exhaustive list of examples includes:
    • the percentage of inbound calls to be answered by a call centre within a specific timeframe;
    • the level of availability of ordering and payment systems of an e-commerce website within a specific timeframe;
    • the restoration time for accessing essential shared folders via a cloud file access system; and
    • the timeframe within which the full functionality of the remote work infrastructure is restored.
  • Maximum acceptable outage (MAO) or maximum tolerable period of disruption (MTPD) to determine the time it would take for the potential impacts of not providing a product/service or performing an activity to become unacceptable or significant, in accordance with the risk assessment. Typically they are longer than RTOs. MAOs focus on service availability while RPOs focus on data loss. An indicative and non-exhaustive list of examples:
    • the period of time beyond which the customer service would be severely impacted and reputation risk increases quickly;
    • the longest period of time that extended outage of an e-commerce website might result to major loss of sales and customer trust;
    • the longest period of time that shared access to project files may halt collaboration or decision-making in case that data is stored in cloud; and
    • the maximum acceptable outage for remote work infrastructure beyond which business functions are significantly impaired and productivity losses begin to escalate.
• RTOs, RPOs and SDOs may be used to determine backup and redundancy procedures.
• Document disaster recovery plan, taking into account:
  • the RTOs, RPOs and SDOs; and
  • compliance with applicable regulations and legislation.

Examples of evidence

• Documented BIA with specific recovery objectives.
• Processes, procedures and measures to ensure the required level of continuity in disruptive situations.

1. Overzicht

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

3. Gerelateerde regelingen

Gekoppelde issues

• ENISA -