Using Business Impact Analysis to Inform Risk Prioritization and Response

Key concepts

Assets are catalogued and ranked by their value to the mission, considering confidentiality, integrity and availability. The ranking then drives protection priorities and response choices, so effort goes to the most critical assets first.

How it is organized

• Introduction
• Cataloguing and categorizing assets by enterprise value (business impact analysis)
• Conclusion

What a school district should take from it

• List the systems that would stop instruction, meals, transportation, payroll or safety, and how long each can be down.
• Recovery order should be agreed before an incident, not during one.

How to use it in your district

1. Hold a one-hour session with each department to rate impact if its key system is unavailable for a day and a week.
2. Record the agreed recovery order and maximum downtime for each critical system.
3. Use the ranking to prioritize backups, MFA and monitoring work in the Improvement plan.

Common misconceptions

Business impact analysis is only for disaster recovery plans.

The same ranking should guide security spending and incident response priorities.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

• GV.RMRisk Management Strategy
• ID.AMAsset Management
• RC.RPIncident Recovery Plan Execution

Tools in the program portal

• Improvement planGive each gap an owner, a date and a first step
• Tabletop exercisesRun a scenario and capture after-action improvements
• Cyber insurancePolicy conditions, questionnaire and Breach Day card
• School-year operations plannerSchedule recurring security work across the year

Related publications

• IR 8286 Rev. 1Cyber risk and enterprise risk management
• SP 800-34 Rev. 1Contingency planning