Whether it’s an attempt to breach the network or a complete shutdown of information systems, cyber-attacks are highly disruptive events. Unfortunately, they do happen. Depending on the extent of the incident and its impact on business operations, the consequences can be extremely severe. Key indicators of the severity of attacks include the volume of exposed information, financial losses for affected organizations, and reputational damage.
As a mechanism for information security management, ISO/IEC 27001 requires organizations to assess security threat risks and perform impact analysis. Traditional Business Impact Analysis (BIA) is used for recovery planning in cases of disruptions, such as loss of physical access to the office or data centre outages and internet interruptions.
Until recently, all applications and data were located in an organization’s own data centre, and analyses focused on disruptions and losses due to destruction or inaccessibility of the data centre -everything under the organization's control, making the analysts' job relatively simple. However, things have become more complex. In recent years, there has been a trend toward wider use of cloud applications and services, such as data storage in third-party data centres or software-as-a-service (SaaS) in the cloud. With the modern distribution of applications and data, it is unlikely that all systems would be affected simultaneously by a cyber-attack. This means that a business may continue to operate with unaffected systems while attempting to restore the compromised parts of its infrastructure. At the same time, there is a risk of malware spreading through interfaces between different systems, so even unaffected applications need thorough scanning, which takes time and may disrupt processes.
Additionally, not all applications are equally important to the organization’s operations. There are critical applications that are especially vital. For example, in manufacturing, this might be the enterprise resource planning (ERP) system; in accounting, a document processing system; and in retail, the inventory system. The loss of these applications could lead to significant operational disruptions and losses for the organization.
Conducting an impact analysis before an attack occurs is a way of managing the business. It is a tool that allows organizations to determine in advance the extent to which their operations would be interrupted, the expected financial losses, and the number of loyal customers that would remain. This analysis answers questions such as, "How long can the business be without its core systems before its stock price takes an unacceptable drop or before it loses viability?"
One of the outcomes of the impact analysis is to determine information security control mechanisms to mitigate the impact of cyber-attacks, reduce the recovery time for affected systems, and set parameters for necessary investments in prevention, detection, and recovery from cyber-attacks. Investment needs include a detailed analysis of business processes and how information systems are used to generate revenue, serve customers, pay wages, and maintain control over all aspects of operations.
Some recommended measures to reduce recovery time include maintaining multiple generations of backup copies, routinely scanning software and data for intrusions, separating testing and analysis environments, and conducting frequent recovery exercises.
 
Performing business impact analysis on risks related to information security is not only a requirement of ISO/IEC 27001 but also of various national and European standards. The experts at CONSEJO assist in implementing these requirements, managing risks, and executing security policies.