I requested some information regarding our ISO Business impact analyses questionnaire and what the correct process would be the complete these for our implementation. The response we got was that only document business process should be documented, but we are now again at a point in the process where we are not sure which processes should be listed and if we need to document things like physical links at our office not available.
The scenario I can share with you is that we have an office where some of our core systems are located.
1 - What impact analyses should I document?
2 - Do I do a granulate approach and document things like power outages or does things like power outages become a prerequisite to a process not being available.