Appendix A – Business Impact Analysis
To determine the priority for classification of information assets and the corresponding level of security protection
a weighted impact assessment needs to be undertaken. If the Agency has an existing method for assessment of
business impact, this MAY be used instead of the one provided in this Appendix.
The NIA recommended BIA is undertaken by rating the impact of loss or degradation of a process on the Agency
using the following impact factors:
1. Impact on Reputation
2. External Impact (impact on external entities, other Agencies, public etc.)
3. Internal Impact (impact on employees and the Agency itself)
4. Legal Impact (liabilities due to non-fulfilment of legal obligations e.g. not complying with service level
agreements, regulations, legislation etc.)
5. Economic Impact (loss of direct revenue, lost opportunities etc.)
The following steps should be undertaken to rate a processes criticality:
1. For each of the impact factors, rate the factor’s importance to the Agency, based on the following
rating. This weighting factor (α1 to α5) is calculated only once and is used for each process being
assessed.
a. 0: Not Important
b. 1: Low importance
c. 2: Medium importance
d. 3: High importance
e. 4: Very high importance
2. For each process, identify the impact (I) to the Agency upon its loss or degradation, using the following scale. For
time dependent processes, ensure that impact at peak usage times is calculated.
a. 0: No impact
b. 1: Low impact
c. 2: Medium impact
d. 3: High impact
e. 4: Very high impact
3. Use the following formula to determine a criticality (on a scale of 100) for each process. :
impactvalue =1.25 (α1I1 +α2I2 +α3I3 +α4 I4 +α5I5 )
Worked Example
Organisational Impact Factor weightings:
1. Reputation Impact Weight: High importance (α1=3)
2. External Impact Weight: High importance (α2=3)
3. Internal Impact Weight: Medium importance (α3=2)
4. Legal Impact Weight: Very high importance (α4=4)
5. Economic Impact Weight: Medium importance (α5=2)
Process Name: Salary Processing, Impact at Critical Time
1. Reputation Impact: High impact (I1=3)
2. External Impact: Low impact (I2=1)
3. Internal Impact: High impact (I3=3)
7
NATIONAL INFORMATION CLASSIFICATION POLICY