A project team has completed a business impact analysis for its systems and proposes to use it as the systems' security risk assessment to save time. Why is this insufficient?
Select an answer to reveal the explanation.
Short Explanation
A BIA tells you how much it'd hurt if a system went down, but not how likely that is to happen. Risk needs both halves: impact and likelihood. The trap is thinking a great impact study is the whole story.
Full Explanation
A business impact analysis identifies critical business processes and the consequences over time of their disruption, producing criticality rankings and recovery objectives. It answers how much harm an outage or loss would cause, but it does not examine threats, vulnerabilities, existing controls or the likelihood that a given scenario will occur. A risk assessment combines impact with likelihood and evaluates the effectiveness of controls, which is what risk treatment decisions require. The business impact analysis is therefore a valuable input to the risk assessment, especially for impact values, but it cannot stand in for one. Claiming that a business impact analysis is limited to financial impacts is incorrect; it typically considers operational, regulatory, reputational and contractual consequences as well. Business impact analyses are normally led by business continuity or risk functions with process owners, not reserved to internal audit, and reusing the results is encouraged. Saying it has no bearing on security decisions ignores that criticality from the analysis directly shapes protection priorities. Exam caveat: confusing these two activities is a classic CISM trap, so remember which question each one answers. Operational check: confirm the project's risk assessment cites the business impact analysis for impact and separately documents threats, vulnerabilities, controls and likelihood.