BCM-02—Business impact analysis policies and instructions
>Control Description
Policies and instructions to determine the impact of any malfunction to the cloud service or enterprise are documented, communicated and made available in accordance with SP-01. The following aspects are considered as minimum:
• Possible scenarios based on a risk analysis;
• Identification of critical products and services
• Identify dependencies, including processes (including resources required), applications, business partners and third parties;
• Capture threats to critical products and services;
• Identification of effects resulting from planned and unplanned malfunctions and changes over time;
• Determination of the maximum acceptable duration of malfunctions;
• Identification of restoration priorities;
• Determination of time targets for the resumption of critical products and services within the maximum acceptable time period (RTO);
• Determination of time targets for the maximum reasonable period during which data can be lost and not recovered (RPO); and
• Estimation of the resources needed for resumption.
Additional criteria: -
Ask AI
Configure your API key to use AI features.