The person selected should be a mid-level manager that has a good understanding of business applications and services. This person will serve as the single point of contact for ensuring that a Disaster Prevention and Recovery Program is developed and maintained. A Business Impact Analysis is then conducted. This process consists of a business impact analysis and a risk analysis. Risk Analysis - A process that is conducted, if sensitive business functions are identified during the Business Impact Analysis.
Sensitive information is information that is both confidential and critical.
A Risk Assessment of ALL Information Technology services, and applications is conducted to identify risks, to determine their magnitude, and to identify safeguards. After the Business Impact Analysis and the Risk Assessment is completed, a formal document must be prepared summarizing the findings. Successful completion of the Business Impact Analysis should lead to the identification of all business activities and the relative applications required for support. The summary must then document existing safeguards for each of the threats. If the appropriate safeguards are not in place, then the summary should document an action plan for developing and deploying all that is deemed necessary.