System-wide criticality settings
Choosing a suitable criteria for system-wide criticality calculations
Operational components include products, services or other critical objectives; processes or activities; and assets and resources. Criticality is used in the BCMS to identify those operational components that are considered to be most important to the organization and would have the greatest disruptive impact if one or more of those components became interrupted or unavailable. The criticality settings allow the establishment of priorities for resilience and recovery investment that is based on the results of approved risk assessment and BIA analysis. Criticality settings are linked to either the RTO or MTPD system-wide settings. The system-wide BIA criticality settings are located on the left hand side of the BIA set up screen. Click the "BIA set up" button on the BIA pop-up and the following screen appears:
The User is able to customize the system-wide settings for calculating criticality levels. Within the BIA process, impact levels need to be assessed for each impact category as applied to the products, services and other critical objectives. These impact ratings are applied to each of five User assigned system-wide pre-set time periods. There are six pre-set impact levels namely, "Disastrous"; "Very serious"; "Serious"; "Not serious"; "Negligible" and "No Impact". The User customizes the impact categories, the time periods and the definition of each impact level for each impact category. These BIA based impact levels are also used to calculate criticality.
The User can choose to set the criticality ratings to either match the RTO settings or the MTPD settings. Basing the criticality ratings on the RTO settings, which is the recommended setting, this will mean aligning criticality values with RTO values as an acceptable level of risk. Using the RTO values rather than the MTPD values would represent a higher level of overall criticality. The software is delivered with a default of the RTO settings forming the basis of the criticality ratings.
Setting the Criticality dependency adjustments in the Business Continuity information
Operational components include products, services or other critical objectives; processes or activities; and assets and resources. Through the automated BIA calculations, the criticality values are passed on to any mapped components. The business continuity has a function in the BIA set-up area that allows the User to select one of three system-wide options that govern how criticality ratings change following the application of dependency ratings between mapped components . The default level is Option 2.
Criticality dependency option 1 - No adjustment
The first option "No adjustment" passes the criticality value through the dependency function to mapped components without making any changes to the criticality value irrespective of dependency level.
Criticality dependency option 2 - Standard adjustment
The second option "Standard adjustment" adjusts the criticality values to mapped components as follows: If dependency level set at "Very high" or "High" dependency rating - no criticality adjustment; "Medium" or "Low" dependency rating - moves the criticality value down one level and "Very low" moves the criticality value down two levels. The lowest adjusted criticality value is "Minimal".
Criticality dependency option 3 - Maximum adjustment
The third option "Maximum adjustment" adjusts the criticality values through the dependency function to mapped components as follows: "Very high" dependency rating - no criticality adjustment; "High" dependency rating - moves the criticality value down one level; "Medium" dependency rating - moves the criticality value down two levels; "Low" dependency rating - moves the criticality value down three levels; and "Very low" moves the criticality value down four levels. The lowest adjusted criticality value is "Minimal".
Reference material:
- More details on business risk analysis in line with ISO31000 can be obtained from www.business-continuity-expert.com/bce-business-risk-analysis.htm
- Go to www.business-continuity-expert.com/bce-crisis-management.htm for explanations on crisis management
- To obtain extra info on contingency management go to www.business-continuity-expert.com/bce-contingency-management.htm