Risk Assessment and Business Impact Analysis for Disaster Recovery
What the exam tests
This domain tests whether you can connect risk assessment and BIA outputs to recovery priorities, RTOs, RPOs, and resource requirements.
Core rules
- Risk assessment identifies threats, vulnerabilities, likelihood, and impact, then evaluates treatment options. It informs scenario selection; it does not replace the BIA.
- The BIA identifies critical activities, dependencies, impact over time, MTPD, RTO, RPO, and minimum resources: people, systems, data, suppliers, and facilities.
- RTO must not exceed MTPD. The gap between them is the time available for detection, assessment, declaration, and mobilization.
- Capture interdependencies: an activity may depend on identity, network, payment, or a single supplier. Cumulative impact can exceed the sum of individual outages.
- Validate BIA data with activity owners and walkthroughs; document assumptions.
Worked example
Payroll has an MTPD of 3 days, RTO of 2 days, and RPO of 1 day. It depends on the HR system, time capture, and banking files. Reasoning: a 2-day RTO leaves one day before MTPD; daily data extraction meets the 1-day RPO. The strategy must restore HR data, time capture, and bank-file production, not just the payroll application. A single identity service supporting all three becomes a priority dependency.
Traps
Running a BIA as an IT asset inventory; interviewing only senior managers; accepting vendor RTOs without validating dependencies; ignoring manual workarounds; and setting RTO equal to MTPD with no assessment time.