This is a tool used to set a baseline for how your business would react to any disruptions to normal work flow and can show where everyday functions can be improved. Cybersecurity is rapidly becoming a critical addition to business operations and a way to keep businesses competitive and assets protected. The first step when conducting a BIA is to create an objective for running the test and create an outline of areas to assess with your team. Try to include a representative from each department and run it similarly to your health and safety meetings.
As you move through each department, note the condition of hardware; desktops, servers, internet speed and connectivity, any hazards caused by messy wires in high traffic areas. Make sure each department gets a chance to voice concerns that they notice daily. Also make a note of how that area would be impacted by a natural disaster, loss of power or service interruption. Is there a game plan for how the business would function in each case? What would the financial and legal outcome be if the business was not properly protected.
After a walk through has been completed by the team each department should have tasks to complete to improve their area. To update and communicate SOP’s for their team so that in the event of loss of power, data breach or equipment failure each department has a game plan to be able to continue to run their day. For example, hard copies of employee, client and vendor contacts should be kept in a locked file easily accessible to management to be able to easily contact and reschedule staff and clients. When discussing replacing or upgrading equipment be realistic about when you need to replace items and discuss a back up solution for any items you can store close by. Set Due dates for tasks like: sourcing out internet solutions, replacing or upgrading slow equipment, making folders accessible on the cloud and creating tiered admin access. Have your team schedule repairs, software upgrades and patches. Discuss relationships with Vendors the policy for payments being sent and received. What would the damage be if an employee was tricked into wiring a bad actor money.
Document findings, changes and upgrades made after the initial assessment and make note of outstanding task items. Include this document during health and safety meetings to hold departments accountable for making changes.
After an initial assessment your team will be empowered and more aware of their department’s responsibility to the business on a daily basis and during an unexpected event. Daily functions of the business will run smoother because of advanced scheduling and better communication. Business spending will decrease because more care will go into upgrading equipment, updating policies and improved security. When businesses include cyber training, acceptable use policy and cybersecurity software such as DNS Filter, EDR and MDR monitoring and a good email filter the boss sleeps better at night. In an event that electronic