Handbook of Information Security Management:Risk Management and Business Continuity Planning

Previous Table of Contents Next


BIA INTERVIEW LOGISTICS AND COORDINATION

This portion of the report will address the logistics and coordination while performing the BIA interviews themselves. Having scoped the BIA process, the next step is to determine who and how many people you are going to interview. In order to do this, there are some techniques you might use:

  Use Organizational Charts to Compile Lists of Interviewees — You certainly are not going to interview everyone in the organization. You must select a sample of those management and staff personnel who will provide you with the best information in the shortest period. In order to do that, you must have a precise feel for the scope of the project (i.e., technological platform recovery, business unit recovery, communications recovery, etc.) and with that understanding you can use:
1.  Organizational Chart Reviews — The use of formal, or sometimes even informal organization charts is the first place to start. This method includes examining the organizational chart of the enterprise to understand those functional positions that should be included. Review the organizational chart to determine which organizational structures will be directly involved in the overall effort and those that will be the recipients of the benefits of the finished recovery plan.
2.  Overlaying Systems Technology — Overlay systems technology (applications, networks, etc.) configuration information over the organization chart to understand the components of the organization that may be affected by an outage of the systems. Mapping applications, systems, and networks to the organization’s business functions will aid tremendously when attempting to identify the appropriate names and numbers of people to interview.
3.  Interview Technique — This method includes conducting introductory interviews of selected senior management representatives in order to identify critical personnel to be included in the BIA interview process.
  Coordinate with the IT Group — If the scope of the BIA process is recovery of technological platforms and/or communications systems, then conducting interviews with a number of IT personnel could help shorten the data-gathering effort. While IT users can often provide much valuable information, they should not be relied upon solely as the primary source of business impact outage information (i.e., revenue loss, extra expense, etc.).
  Send Questionnaire out in Advance — It is a useful technique to distribute the questionnaire to the interviewees in advance. Whether it is in hard copy or electronic media format, the person being interviewed should have a chance to review the questions, be able to invite others into the interview or redirect the interview to others, and begin to develop the responses. You should emphasize to the people who receive the questionnaire in advance to not fill it out, but to simply review it and be prepared to address the questions.
  Schedule One-Hour Interviews — Ideally, the BIA interview should last between 45 and 75 minutes. We have found that it sometimes can be advantageous to go longer than this, but if you see many of the interviews lasting longer than the 75-minute window, then there may be a BIA scoping issue which should be addressed, necessitating the need to schedule and conduct a larger number of additional interviews.
  Limit Number of Interviewees — It is important to limit the number of interviewees in the session to one, two, or three, but no more. Given the amount and quality of information you are hoping to elicit from this group, more than three people can deliver a tremendous amount of good information that can be missed when too many people are delivering the message at the same time.
  Try to Schedule Two Interviewers — When setting up the BIA interview schedule, try to ensure that at least two interviewers can attend and take notes. This will help eliminate the possibility that good information may be missed. Every additional trip back to an interviewee for confirmation of details will add overhead to the process.


Previous Table of Contents Next



The CISSP Open Study Guide Web Site

We are proud to bring to all of our members a legal copy of this outstanding book. Of course this version is getting a bit old and may not contain all of the info that the latest version are covering, however it is one of the best tool you have to review the basics of security. Investing in the latest version would help you out in your studies and also show your appreciation to Auerbach for letting me use their book on the site.