Day 1: BIA Scope and Critical Services

Defining Business Continuity Scope

• Approved scope for impact analysis
• Services included within impact study
• Analysis boundaries and owner responsibility
• Assumptions documented before stakeholder interviews

Prioritizing Critical Services

• Service criticality across disruption time
• Minimum level for service continuity
• Service outage impact on customers
• Service ranking across disruption time

Business Impact Analysis and Recovery Priorities

• Impact progression across disruption time
• Maximum tolerable period of disruption
• Impact threshold triggering recovery priority
• Activities ranked by disruption damage

Day 2: Disruption Impact and Recovery Objectives

Analyzing Business Dependencies

• People and systems supporting activities
• External dependencies affecting activity recovery
• Failure points interrupting critical activity
• Alternatives reducing recovery dependency exposure

Recovery Time and Data Objectives

• Justification for targeted recovery time
• Justified threshold for data loss
• Recovery timing aligned with dependencies
• Objectives approved with documented justification

Selecting Continuity Strategies

• Alternatives meeting defined recovery objectives
• Comparing capacity cost and risk
• Alternative capacity closing recovery gap
• Selecting an affordable viable option

Day 3: Continuity Strategies and Readiness Testing

Continuity of Critical Suppliers

• Suppliers supporting business critical activities
• Verified recovery capability of suppliers
• Alternate supplier for critical activity
• Continuity requirements embedded within contracts

Alternate Site Readiness

• Alternate capacity meeting recovery objectives
• Site dependencies before switching operations
• Readiness test before site activation
• Switching criteria linked to objectives

Testing Recovery Plans

• Tests validating recovery planning assumptions
• Evidence demonstrating feasible activity recovery
• Actual time compared with target
• Gaps converted into corrective actions

• Business impact analysis workshop using impact over time
• Exercise setting maximum tolerable disruption and recovery priorities
• Recovery and data-loss objective setting with defensible rationale
• Continuity option comparison across dependencies sites and suppliers