Could you please help me with Business Impact analysis for Business Continuity Management Annex A.17 in ISMS. As per ISMS requirements we have updated the Business Continuity and Disaster Plan as below
Planned alternate site is 10 kilometers away from the primary site. There is no server hardware and internet service available at the moment.
Critical Business Processes (based on Business Impact Analysis) mentioned Recovery Time Objective as 24 hours for internet service . Would like to understand how to define this. How to arrive that hours?
The Recovery Time Objective (RTO) means how fast after a disaster an organization wants its business to resume operations, and its definition is made through the Business Impact Analysis, which helps you understand the level of resources are required and the evolution of losses over time (in shorth, the faster the losses increases over time, the shorter the RTO needs to be, and more resources will be required).
As a reference to evaluate how much resources are enough, you should consider the losses to the organization if the operations are not resumed in a given time. For example, if the losses for not returning in 12h are US$ 200k, and the resources required to return operations at this time cost US$ 250k, then it is not practical to define an RTO of 12h. On the other hand, if the losses for not returning in 14h are US$ 1M, and the resources required to return operations at this time cost US$ 750k, then it is practical to define an RTO of 24h.
These articles will provide you with a further explanation about business continuity concepts: