2 cissp ® Official Study Guide Eighth Edition

Likelihood Assessment
The preceding step consisted of the BCP team’s drawing up a comprehensive list of the 
events that can be a threat to an organization. You probably recognized that some events are 
much more likely to happen than others. For example, an earthquake is a much more likley 
risk than a tropical storm for a business located in Southern California. A business based in 
Florida might have the exact opposite likelihood that each risk would occur.

---

Business Impact Assessment 
109
To account for these differences, the next phase of the business impact assessment identi-
fi es the likelihood that each risk will occur. To keep calculations consistent, this assessment 
is usually expressed in terms of an
annualized rate of occurrence
(ARO) that refl ects the 
number of times a business expects to experience a given disaster each year. 
The BCP team should sit down and determine an ARO for each risk identifi ed in the 
previous section. These numbers should be based on corporate history, professional experi-
ence of team members, and advice from experts, such as meteorologists, seismologists, fi re 
prevention professionals, and other consultants, as needed. 
In addition to the government resources identified in this chapter, insur-
ance companies develop large repositories of risk information as part of 
their actuarial processes. You may be able to obtain this information from 
them to assist in your BCP efforts. After all, you have a mutual interest in 
preventing damage to your business!
In many cases, you may be able to fi nd likelihood assessments for some risks prepared 
by experts at no cost to you. For example, the U.S. Geological Survey (USGS) developed the 
earthquake hazard map shown in Figure 3.1 . This map illustrates the ARO for earthquakes 
in various regions of the United States. Similarly, the Federal Emergency Management 
Agency (FEMA) coordinates the development of detailed fl ood maps of local communities 
throughout the United States. These resources are available online and offer a wealth of 
information to organizations performing a business impact assessment. 
F I G u r e 3 .1
Earthquake hazard map of the United States
(Source: U.S. Geological Survey)

---