Identify your critical functions and their requirements

Identify your organisations’ critical functions, and what’s needed to keep them running or restore them promptly.

Your organisation’s critical functions are the ones you most need to maintain in a disruption. When you’re identifying your critical functions, consider the scope of your business continuity programme, and evaluate the impact over time of a disruption to these functions.

Consider your resources and requirements

Which resources and requirements are essential for maintaining your critical functions? Think about:

• people and their capabilities
• facilities
• supplies and equipment
• information
• technology (systems, applications)
• suppliers of goods and services.

Conduct a business impact analysis

Business continuity professionals use a technique called business impact analysis to identify business continuity requirements.

A business impact analysis can capture varying levels of detail. Consider your organisation’s needs, and the stage you are at in implementing your programme.

In your business impact analysis:

• Identify the requirements necessary to deliver the function
• Assess the impact of a disruption to the function and related timeframes
  • At what point would the impact be unacceptable (the maximum tolerable period of disruption)?
  • When do you aim to recover this function by (your recovery time objective)?
  • At what point do you need the identified requirements, so you can achieve the recovery time objective?
• Identify any other internal or external people, services, or suppliers that the function depends on
• Determine how critical the function is over time. 

Carry out a risk assessment

A business impact analysis should include a risk assessment to identify and quantify the risk of disruption to the function, including risks to the requirements the function needs. Collaborate with the people in your organisation who are responsible for risk management to carry out the risk assessment. Remember to consider risks that your organisation has already identified, and any measures for reducing them that are already in place.

Take a wide view

Collate and review the information from your business impact analysis, taking an organisation-wide perspective. You can then consider:

• interdependencies between functions 
• shared requirements across your organisation.

Page last modified: 4/05/2022