Guest
Which is first - BIA or risk assessment?
I´ve got a question about the order between BIA and RIA, what is the correct order? In DRII is RIA process and then BIA but had read in others organization that is BIA first and then RIA.
Assign topic to the user
Answer: I assume that by "RIA" you refer to risk assessment. ISO 22301 is fine with both approaches - risk assessment first and BIA second, or the other way around.
My preference is to perform the risk assessment first because you will have a much better feeling about which incidents can happen (and therefore better assess the impact during BIA), but you can also use the list of assets you identified during your risk assessment as an input for BIA when you need to identify all the required resources.
Comment as guest or Sign in
Jan 12, 2016
Jan 12, 2016
Jan 12, 2016