Business Impact Analysis -
CI Risk Mgmt. 5/2014 Business Continuity Planning
IDENTIFY YOUR CRITICAL FUNCTIONS OR MAJOR SERVICES: The first column on the left below asks you to list your department’s critical
functions or major services. The second column asks you which of these are “critical” and to rank them in priority in support for the University’s
core objectives. The third column is to note the key dependency your department may have on another department in order to deliver your
critical service. Focus on critical services and functions only.
• Identify services and functions, not processes.
• Examples of services/functions:
o Teaching
o Paying employees
o Student admissions
o Laboratory research and discovery
o Communications, monitoring and dispatching
o Providing meals for residents of university housing.
o Security checks and patrols
• Definition of “critical” – A service or function is “critical” if it is
essential to supporting instruction, and a safe and secure
environment. More specifically, a critical service or function is one
that must be re-started, within a time period no longer than its
maximum allowable downtime (MAD), in order to enable
instruction, research, or safety and security to continue.
• Interdependencies. In some cases, delivery of services may be
dependent on those provided by a different area or department.
Note the department and the service that impacts your critical
service.
• Prioritize your critical services and functions remaining focused on
maintaining the University’s core businesses during an outage or
disaster.
• If there is a reason that a service or function must be recovered
immediately (e.g. regulatory requirement), include that in the
critical prioritization.
CRITICAL FUNCTION/SERVICE PRIORITY RANK
UNIT OR DEPT ON WHICH YOU DEPEND IN ORDER TO CARRY
OUT THIS CRITICAL FUNCTION
1
2
3
4
5
6
7
8
9
10
Business Impact Analysis -
CI Risk Mgmt. 5/2014 Business Continuity Planning
DETERMINING MAXIMUM ACCEPTABLE DOWNTIME (MAD) AND RECOVERY TIME OBJECTIVE (RTO)
In the table below, list critical services you identified and prioritized. List them in priority order starting with the most important. Check off the time area that
service can be down before negative consequences occur. Note: The RTO should be a shorter time period than the MAD.
RANK Critical functions What is the MAD before negative consequences occur?
RTO -When will this critical function
resume in some fashion?
Align with your BCP.
0-8 hrs 9-24 hrs 25-72 hrs 4-14 days 15-30 days 30+days (Ex.: 2 days)
1
2
3
4
5
6
7
8
9
10
The business continuity plan should be written with the MAD and RTO for each critical function in mind. Analyzing and developing pre-plans
in the event of a disaster or major outage will assist during the chaotic first stage of a major unplanned event.