ISO/DTS 22317-2015: Societal security – Business continuity management systems – Business impact analysis

1 Scope
2 Normative references
3 Terms and definitions
4 Prerequisites
	4.1 General
	4.2 BCM Programme Context and Scope
		4.2.1 BCM Programme Context
		4.2.2 Scope of the BCM Programme
	4.3 BCM Programme Roles
		4.3.1 BCM Programme Roles and Responsibilities
		4.3.2 BIA-Specific Roles and Competencies
	4.4 BCM Programme Commitment
	4.5 BCM Programme Resources
5   Performing the Business Impact Analysis
	5.1 Introduction
	5.2 Project Planning and Management
		5.2.1 Introduction (overview)
		5.2.2 Initial versus Ongoing BIA Processes
	5.3 Product and Service Prioritization
		5.3.1 Introduction (Overview)
		5.3.2 Inputs
		5.3.3 Outcomes
	5.4 Process Prioritization
		5.4.1 Introduction (Overview)
		5.4.2 Inputs
		5.4.3 Outcomes
	5.5  Activity Prioritization
		5.5.1 Introduction (Overview)
		5.5.2 Inputs
			5.5.2.1 Information
			5.5.2.2 Resource requirements
			5.5.2.3 Interdependencies
		5.5.3 Outcomes
	5.6 Analysis and Consolidation
		5.6.1 Introduction (Overview)
		5.6.2 Inputs
		5.6.3 Methods
		5.6.4 Outcomes
	5.7 Obtain Top Management Endorsement of BIA Results
		5.7.1 Introduction (Overview)
		5.7.2 Inputs
		5.7.3 Methods
		5.7.4 Outcomes
	5.8 Next Step – Business Continuity Strategy Selection
6 BIA Process Monitoring and Review
Annex A  (informative)  Business Impact Analysis within an ISO 22301 Business Continuity Management System
Annex B  (informative) Business Impact Analysis Terminology Mapping
Annex C  (informative) Business Impact Analysis Data Collecting Methods
	C.1 Documentation Review
	C.2 Interview
	C.3 Survey/Questionnaire
	C.4 Workshops
	C.5 Scenario-based exercise
Annex D  (informative) Other Uses for the Business Impact Analysis Process
	D.1 Collection of Additional Recovery Planning Information
	D.2 The collection of information useful for plan development and incident response
		D.2.1 Increasing the efficiency of the organisation
		D.2.2 To explore alternative strategic planning options
		D.2.3 To assist with longer term strategy decision-making
		D.2.4 Project or event BIA
		D.2.5 BIA as a Risk Analysis