One aspect of this topic is about IT dependencies that the process depends on to perform the function of the process...  These IT dependencies are infrastructure or application that a department needs (primarily applications).  We ask them what applications they depend on, describe the dependency, desired RTO and RPO and if they have any alternate or manual workarounds.

Another aspect of this is the technology impact assessment.  We need to capture a full inventory (source of truth) for applications and infrastructure.  We need to discover any shadow IT systems, appl, infra.  We need to know their RTO, RPO, architecture design, DR architecture, criticality of the application, resiliency, redundancy and recovery capabilities.  We need to know the backup type, frequency and retention.  We want to know if all of it is documented (i.e. DR Plan, runbooks, SOPs, etc)

For those that are starting from ground zero, I have provided an easy way to capture technology dependencies - see attached screenshot.

• Methodology: Identify all of the systems/applications that the department/business function depends on for their service/process.

• Sample Questions: 
  • Identify the application/system used for your process
  • Is it SaaS, on prem, home grown?
  • What is the impact to your service/process if this technology was not available?
  • Identified recovery capability?
  • RTO and RPO?

• Best Practices: 
  • Review the data you gathered with the application or system owners
  • If RTO and RPO information is provided, ask how these were derived and ask for "evidence" to support it.  

Holistic Resilience Planning

An aspect of a TIA/BIA that may be overlooked is utility. Utilities such as power, water, and HVAC systems are critical components that support the operational environment of applications. If these utilities fail, they can cause significant disruptions, even if the applications themselves are not directly affected.
While utilities might not directly define RTO (the maximum acceptable length of time that an application can be offline) and RPO (the maximum acceptable amount of data loss measured in time), their failure can impact the ability to meet these objectives. If an application has a stringent RTO or RPO, but the underlying infrastructure (powered by utilities) is unreliable, then the RTO/RPO goals may become unachievable in practice.

Including utility aspects in your assessments ensures that you are planning for resilience at a systemic level, rather than just at the application level.

• Identify Critical Utilities: List all the utilities that support your applications and business processes (e.g., power, water, HVAC, internet connectivity).
  Assess Dependency and Impact: Determine how each utility affects the operations of applications and business processes. Identify the critical dependencies and potential impacts of utility failures.
• Mitigation Strategies: Develop and implement mitigation strategies, such as UPS systems, backup generators, redundant cooling systems, and alternative network connections.
• Integrate into BIA: Include utility failure scenarios in your BIA process. Assess the impact of utility failures on RTO and RPO, and adjust your recovery plans accordingly.