2 cissp ® Official Study Guide Eighth Edition

Business Organization Analysis 
One of the fi rst responsibilities of the individuals responsible for business continuity plan-
ning is to perform an analysis of the business organization to identify all departments and 
individuals who have a stake in the BCP process. Here are some areas to consider: 
■
Operational departments that are responsible for the core services the business pro-
vides to its clients 
■
Critical support services, such as the information technology (IT) department, facilities 
and maintenance personnel, and other groups responsible for the upkeep of systems 
that support the operational departments 
■
Corporate security teams responsible for physical security, as they are many times the 
first responders to an incident and are also responsible for the physical safeguarding of 
the primary facility and alternate processing facility 
■
Senior executives and other key individuals essential for the ongoing viability of the 
organization
This identifi cation process is critical for two reasons. First, it provides the ground-
work necessary to help identify potential members of the BCP team (see the next section). 
Second, it provides the foundation for the remainder of the BCP process. 
Normally, the business organization analysis is performed by the individuals spear-
heading the BCP effort. This is acceptable, given that they normally use the output of the 
analysis to assist with the selection of the remaining BCP team members. However, a thor-
ough review of this analysis should be one of the fi rst tasks assigned to the full BCP team 
when it is convened. This step is critical because the individuals performing the original 
analysis may have overlooked critical business functions known to BCP team members that 
represent other parts of the organization. If the team were to continue without revising the 
organizational analysis, the entire BCP process might be negatively affected, resulting in 
the development of a plan that does not fully address the emergency-response needs of the 
organization as a whole. 
When developing a business continuity plan, be sure to account for both 
your headquarters location and any branch offices. The plan should 
account for a disaster that occurs at any location where your organization 
conducts its business.

---

Project Scope and Planning