A draft BIA rates the impact of each process disruption purely in lost revenue. As a result, a customer safety notification process shows low revenue impact and is ranked non-critical. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
Measuring impact only in dollars is like judging a smoke alarm by how much money it makes. Some processes matter because of safety, regulators or reputation, so your BIA has to measure those too. Patching just this one ranking is the trap; the same blind spot would still hide other processes.
Full Explanation
Business impact has several dimensions. A BIA should assess financial loss alongside regulatory and legal consequences, reputational damage, operational disruption, contractual penalties and harm to health and safety, and it should show how each grows as an outage continues. A process with little revenue attached can still be critical because its failure causes injury, breaches obligations or destroys customer trust. Expanding the criteria and reassessing all rankings corrects the method, not just one symptom. Accepting the ranking because revenue is objective confuses ease of measurement with completeness; non-financial impacts can be rated consistently using defined scales. Reclassifying only the safety process fixes the case that happened to be noticed while leaving the flawed methodology in place for every other process. Recalculating revenue over a longer period manipulates the figures to reach a desired answer and still ignores the impacts that actually make the process critical. Exam caveat: qualitative scales are acceptable in a BIA, provided they are defined and applied consistently across processes. Operational check: confirm the BIA template rates each process on every impact category over defined time intervals and that senior management has approved the scales.