The information security manager is coordinating a business impact analysis. Who should provide the primary input on the impact of a disruption to each business process?
Select an answer to reveal the explanation.
Short Explanation
Who do you ask how much it hurts when payroll stops? The people who run payroll. Process owners are the source of truth for business impact. Going to IT is the trap here; they know the servers, but not what an outage costs the business.
Full Explanation
Business impact is a business judgement. Process owners understand what each process delivers, which customers and obligations depend on it, how impact grows as an outage continues, which workarounds exist and what upstream and downstream dependencies it has. They are therefore the primary source of BIA input, with the security or continuity function coordinating the method and senior management validating the results. The IT operations team knows the technology supporting each process and is essential for mapping system dependencies and recovery capability, but it cannot authoritatively state business consequences or tolerances. Internal audit reviews controls and may later assess the BIA process, but providing the input would compromise its independence and it does not own the processes. External consultants can facilitate interviews and bring method and benchmarks, yet they lack first-hand knowledge of the organization's processes and cannot own the conclusions. Exam caveat: input from several levels within a process, not only its most senior manager, often gives a more accurate picture. Operational check: confirm each BIA entry names the process owner who provided and signed off the impact assessment, and that IT dependency mapping was reconciled with it.