Attachment-G2-ACF_Business Impact Analysis.docx_V1.0.docx

Enter System Name ACF

Business Impact Analysis Enter System Name Select System Category

Version 1.0 Dated: 6/26/25

Table of Contents

1. Introduction and Purpose Identify and prioritize critical system components based on their support for mission and business processes and to assess the impact of system unavailability.

2. System Overview Include a link to the System Security Plan (SSP) to provide a system overview. Be sure it includes the system name, system acronym, FIPS 199 impact level, operating environment, physical location, general location of users, partnerships with external organizations and systems, and an architectural diagram.

Enter link to System Security Plan (SSP)

3. Critical Business Functions Identify the business processes that rely on the system and explain the purpose of each.

Table 1. Business Processes and Their Purpose

4. Impact Analysis

4.1 Outage Overview

Briefly describe the overall impact of a system outage.

Enter overall impact

4.2 Outage Impact Details

Identify impact categories that represent critical areas if a disruption occurs. Describe the nature of each impact value.

Table 2. Business Processes and Their Purpose

4.2.1 Overall Impact on Business Processes

Identify the overall impact on each process if the system became unavailable.

4.2.1.1 Potential impact of damage to public goodwill, image, or reputation

Impact Category

☐ Not Applicable

☐ Minimal: At worst, limited or short-term damage to public trust and the reputation of any party or ACF organization.

☐ Moderate: At worst, serious short-term or limited long-term damage to public confidence, trust, goodwill, or the reputation of any party or ACF organization.

☐ Severe: Severe long-term damage to public confidence, trust, goodwill, or the reputation of any party or ACF organization.

4.2.1.2 Potential impact of financial loss

Impact Category

☐ Not Applicable

☐ Minimal: At worst, a minor unrecoverable financial loss to any party or a negligible agency liability.

☐ Moderate: At worst, a serious unrecoverable financial loss to any party, or a serious agency liability.

☐ Severe: Severe or catastrophic unrecoverable financial loss to any party, or severe or catastrophic agency liability.

4.2.1.3 Potential impact of capability degradation on agency operations or programs:

Impact Category

☐ Not Applicable

☐ Minimal: At worst, a limited adverse effect on organizational operations or programs.

Examples of limited adverse effects:

· Reduced effectiveness in performing primary functions.

· Minor damage to operations or programs.

☐ Moderate: At worst, a serious adverse effect on organizational operations or programs. Examples of serious adverse effects:

· Major loss of ability to perform primary functions effectively.

· Significant damage to operations or programs.

☐ Severe: A severe or catastrophic adverse effect on organizational operations or programs. Examples of severe or catastrophic effects:

· Total inability to perform one or more primary functions.

· Extensive damage to operations or programs.

4.2.1.2 Potential impact to personal safety:

Impact Category

☐ Not Applicable

☐ Minimal: At worst, minor injury not requiring medical treatment.

☐ Moderate: At worst, moderate risk of minor injury or limited risk of injury requiring medical treatment.

☐ Severe: A risk of serious injury or death.

4.2.1.2 The potential impact of non-compliance to Federal, or Congressional laws and regulations:

Impact Category

☐ Not Applicable

☐ Minimal: At worst, a limited adverse effect on non-compliance with Federal or Congressional laws and regulations.

☐ Moderate: At worst, a serious adverse effect on non-compliance with Federal or Congressional laws and regulations.

☐ Severe: At worst, a severe or catastrophic adverse effect on non-compliance with Federal or Congressional laws and regulations.

5. Downtime and Recovery Objectives Describe alternate means for recovering the business processes that rely on the system. If there are no alternate means, state that.

Enter alternate means details

Identify the following acceptable downtime metrics for each business process. Please use hourly increments.

· Maximum Tolerable Downtime (MTD). The longest time that managers are willing to tolerate a disruption to a mission or business function.

· Recovery Time Objective (RTO). The maximum period that a system can be down before it starts to negatively affect other systems or business processes.

· Recovery Point Objective (RPO). The point in time to which data must be recovered after an event occurs; generally measured by the time elapsed since the last successful backup.

Table 3. Business Process Downtime

6. Recovery Priorities List the prioritized recovery order for system resources and identify the expected recovery time following a worst-case disruption (e.g., complete rebuild or replacement).

The complete list of resources should be found in the Enter link to Asset Inventory

Table 4. Order of Recovery

7. Approval and Authorization The undersigned acknowledge they have reviewed this Business Impact Analysis (BIA) and agree with the approach it defines. Changes to this BIA will be coordinated with and approved by the undersigned or their designated representatives.

Enter Business Owner name Digital Signature – Date

Enter System Owner name Digital Signature – Date

John Talieri, CISO or Christopher Miller, Deputy CISO Digital Signature - Date

Document Revision History

Version 1.0 Business Impact Analysis 1 image1.png image2.png