During a business impact analysis, every department head rates their own processes as most critical, making the results useless for prioritizing recovery. What is the BEST way to resolve this?
Select an answer to reveal the explanation.
Short Explanation
When every department says it's number one, somebody with the whole picture has to make the call. That's senior management, weighing each process against what the organization is trying to achieve. You don't settle it yourself on technical grounds; that's the trap that puts the security manager in the business's chair.
Full Explanation
Criticality in a BIA is a business decision that must reflect enterprise priorities, not the perspective of a single department. When self-assessments are inflated, the remedy is for senior management, often through a steering committee, to review the rankings, challenge them against strategic objectives and the defined impact criteria, and approve a single prioritized list. That approval gives the rankings authority and ends the dispute. Having the security manager assign rankings by technical complexity confuses system difficulty with business importance and places a business decision with someone who should facilitate, not decide. Treating all processes as equally critical abandons prioritization, which is the purpose of the exercise, and recovering everything at once is neither affordable nor achievable when resources are constrained. Ranking by headcount uses a proxy unrelated to impact; a small treasury team may be far more critical than a large administrative function. Exam caveat: defined, consistent impact scales reduce inflation before validation, but senior management validation remains the decisive step. Operational check: confirm the final criticality list carries senior management approval and that each ranking can be traced to scored impact criteria.