# Business Impact Analysis of AMM Data: A Case Study
###### Abstract
These assets need to be determined as objectively as possible in terms of their confidentiality, integrity, and availability, which is the cornerstone for the definition of appropriate security measures and is, therefore, the first aspect that this article addresses regarding the specific environment of AMM. However, given the complexity of the issue of cybersecurity and its impact on business objectives, there is a unique and unique approach to determining business impact analysis. This is due to the link between the relevance of homogeneous datasets and the business impacts, but also to the clear justification of the requirements to ensure adequate cybersecurity, as well as their financial costs. This complex approach, based on a data analysis of individual datasets, their impact on the company's business, and an interrogation of the service to cybersecurity, is an innovative issue that is either addressed separately or, more often than not, not at all. This complex approach presents an opportunity to link the technical cybersecurity perspective with a pure business perspective, as required not only by the spirit of standards and recommendations but by the roles of cybersecurity managers and security directors. The shortcomings of existing solutions and approaches can be summarised in a few points:  
* An isolated view of cybersecurity and business requirements. * Separate technology or organizational solutions. * Identification of data assets and downstream services as primary assets. * Use of technical and technological perspectives, without considering datasets. * Insufficient consideration of business requirements. * Insufficient process for mapping and exchange of data assets. The approach and process presented below, developed as a case study, addresses the above shortcomings and limitations. The general advantage of the BIA then is that it can and does draw on generally available information and data, developed, e.g., as part of undergraduate and thesis work, supplemented by publicly guided interviews with the sponsors of individual data assets. The author's findings are then based on the collected data and information, supplemented by the author's specific knowledge of the distribution company environment where he worked as a security manager. Thus, the main research concerns the banning of publicly available information data flows, an assessment of their importance, and the synthesis of BIA documents as inputs for further security analysis and the design of continuity and recovery plans, etc. The article is structured into interrelated logical units. The third chapter presents an analysis of the data used in the AMM system. The technical Object Identification System (OBIS) codes that are used to generate the uniform datasets are presented. These are described in detail, with an emphasis on their meaning, and a model of the data flow of the homogeneous datasets is presented. This is followed by a brief introduction to the prescriptions of data aggregation used for the operation of the whole AMM system, as an important part of the Smart Grid, and for the systems of the regulator and the electricity market operator (EMO). In the next chapter, the criteria for determining dataset values according to the CIA triad and the parameters for BIA are presented. The resulting values of the datasets discarded by the CIA triad and the results of the BIA are presented, and the reasons for and implications of the discarding of the different ascetics involved in the operation of the AMM system are discussed. The discussion chapter then outlines the most important performance requirements that emerged from the implemented BIA and CIA.