How to Conduct a Business Impact Analysis for Disaster Recovery

Your disaster recovery strategy needs to be pretty comprehensive. It’s not just about making sure that your backup is viable. There’s an entire strategy that needs to be put in place and that means identifying the roles of your employees and establishing an action plan. But how do you know what to do unless you have some idea of how the business will be impacted? In order to be proactive about your disaster recovery, you need to have a more complete understanding of how a disaster can affect your business. Conducting a business impact analysis is the best way to identify your needs and start planning. Here’s are some steps you’ll need to take to conduct a business impact analysis for your disaster recovery strategy:

1. Buy in from ownership and senior management
   A Business Impact Analysis will dig into all areas of your business operations and may require some sensitive conversations. Make sure that you get full buy-in from ownership and senior management before you start poking into the day to day operations and organizational management.
2. Business unit interviews
   You’ll need to meet with key leaders in each area or department of your organization. You’ll want to find out the average burdened cost of each employee (salary+benefits+insurance costs), software and hardware that is being used, impact of each technology element if lost for 1 hour, 8 hours, or 1 week. Also, determine the impact (if any) to your clients and customers if that department or business unit goes down.
3. Verify accuracy of data
   As you conduct your interviews and proceed during the analysis, you’ll want to focus closely on the quality of the data rather than the quantity of the data. A single page per business area or unit is perfectly fine. The bottom line is that all the numbers are as accurate as possible, so that you can properly determine how your business will be impacted if it goes down.
4. Analyze your data
   Now that you’ve taken the opportunity to talk through your technology use and the impact on each department, collate that data with estimates for the PER HOUR impact to each department in the event that a disaster lasts 1 hour, 8 hours or a week. This will accurately reflect the true business impact a local, regional or natural disaster might have on your business.
5. Business unit reviews
   After you’ve taken the time to analyze the data, review with the departments to ensure your analysis is accurate and reflects the reality. The department heads will be able to identify any gaps in your analysis and further flesh out the details to help give you the clearest picture of how employees and business will be impacted by a disaster.
6. Apply the data
   Don’t take the time to compile and analyze data that you’re not going to use. Apply the data that you’ve compiled to a develop a comprehensive disaster recovery plan, and address backup and business continuity. The initial cost of business continuity may seem like a lot, but once you’ve taken the time to create a business impact analysis, you’ll have a bigger understanding of the amount of time and money that can be saved through immediate recovery or continuity.

The worst thing you can do is write off a continuity or backup and recovery strategy is unnecessary. Even the smallest business needs to be protecting their data and have a clear strategy in place for how to recover in a disaster. Whether it’s a hurricane, a major system failure, virus or just employee and human error, take the time to understand what your business really stands to lose in the event of a disaster.