Business impact analysis framework and methods

Business Function and Criticality Matrix Worksheet

Organization: Homeland Security

Business Function

Business Process

Criticality

Operations

Communications

Mission-Critical

Operations

Security

Mission-Critical

Operations

Critical Equipment Needs

Mission-Critical

Administration

Critical Staffing and Assignments

Mission-Critical

Administration

Interdepartmental Liaison

Mission-Critical

Communications

High Level (Pentagon, CIA, FBI, President)

Mission-Critical

Finance

Discretionary Funding

Mission-Critical

Marketing

External Media Liaison

Vital

Operations

Supplies needed for Critical Operations

Vital

Communications

2nd Tier

Vital

Human Resources

Payroll

Important

Marketing

External non-critical communications (Web site, etc.)

Minor

Finance

Accounts Payable

Minor

Operations

All other supply requests

Minor

Operations

Regulatory Issues

Minor

Operations

Non-Critical Equipment

Minor

Justifications:

1. Unlike a manufacturing or service company, many of the regular business processes can be put off a few days in the event of a critical issue.

2. Critical issues for Homeland Security are those that will likely affect most of the country (Natural or man-made disasters, attacks, etc.).

3. Critical issues focus on allowing the Department and its liaisons to do their job -- communications are vital, as is the ability to manage both vertically and horizontal through the organizations.

4. Roles that directly support any critical functions (funding, supplies, communications, etc. are critical in order to allow the organization's mission to occur).

5. Note: Media liaison and communications important in this case so that the public will know and understand that all is being done that can be done to mitigate any situation.

Criticality Categories

Mission-critical -- Critical Functions

Process and functions that have the greatest impact on an organization's operations and potential for recovery back to normal. Answer the question: What are the processes within the organization's processes that must be present for your organization to operate or conduct business? The tolerance to the organization's operations is very low when the process is considered mission-critical.

Recovery time must be in 0 -- 12 hours.

Vital -- Essential Functions

This is a middle category between mission-critical and important. This category can be used if you think certain functions are not mission-critical but need to be addressed, such as payroll or certain IT functions.

Recovery time should be in 13 -- 24 hours.