Create abusiness impact analysis on SanGrafix a video game design company. TheBIA should include a descriptive list of the organization’s key businessareas. The BIA helps to identify and prioritize critical IT systems andcomponents. A template for developing the BIA is also provided toassist the user. This list should be in order of importance to thebusiness and each item should include a brief description of thebusiness process and main dependencies on systems, communications,personnel, and information/data. Areas to be considered could include:E-commerce processesE-mail based communicationsOther on-line real-time customer servicesProduction lineProduction processesQuality control mechanismsCustomer service handlingMaintenance and support servicesSales and sales administrationFinance and treasuryResearch and development activitiesHuman resources managementInformation technology servicesPremises (Head Office and branches)Marketing and public relationsAccounting and reportingStrategic and business planning activitiesInternal audit#action=shaI WILL PROVIDE A TEMPLATE FOR THIS PLZ DO FOLLOW THE SAME FORMAT. NOTHING SHOULD BE DIFFERENTAPA FORMAT. NO PLAGIARISMThissample template is designed to assist the user in performing a BusinessImpact Analysis (BIA) on an information system. The template is meantonly as a basic guide and may not apply equally to all systems. The usermay modify this template or the general BIA approach as required tobest accommodate the specific system. In this template, words in italics are for guidance only and should be deleted from the final version. Regular (non-italic) text is intended to remain.1. OverviewThis Business Impact Analysis (BIA) is developed as part of the contingency planning process for the {system name}{system acronym}. It was prepared on {insert BIA completion date}.1.1 Purpose Thepurpose of the BIA is to identify and prioritize system components bycorrelating them to the mission/business process(es) the systemsupports, and using this information to characterize the impact on theprocess(es) if the system were unavailable. The BIA is composed of the following three steps: Determine mission/business processes and recovery criticality. Mission/businessprocesses supported by the system are identified and the impact of asystem disruption to those processes is determined along with outageimpacts and estimated downtime. The downtime should reflect the maximumthat an organization can tolerate while still maintaining the mission. Identify resource requirements. Realisticrecovery efforts require a thorough evaluation of the resourcesrequired to resume mission/business processes and relatedinterdependencies as quickly as possible. Examples of resources thatshould be identified include facilities, personnel, equipment, software,data files, system components, and vital records.Identify recovery priorities for system resources. Basedupon the results from the previous activities, system resources canmore clearly be linked to critical mission/business processes. Prioritylevels can be established for sequencing recovery activities andresources. This document is used to build the {system name}Information System Contingency Plan (ISCP) and is included as a keycomponent of the ISCP. It also may be used to support the development ofother contingency plans associated with the system, including, but notlimited to, the Disaster Recovery Plan (DRP) or Cyber Incident ResponsePlan.2. System DescriptionProvide ageneral description of system architecture and functionality. Indicatethe operating environment, physical location, general location of users,and partnerships with external organizations/systems. Includeinformation regarding any other technical considerations that areimportant for recovery purposes, such as backup procedures. Provide adiagram of the architecture, including inputs and outputs andtelecommunications connections. Note: Information for thissection should be available from the system’s System Security Plan(SSP) and can be copied from the SSP, or reference the applicablesection in the SSP and attach the latest version of the SSP to thiscontingency plan.3. BIA Data Collection Datacollection can be accomplished through individual/group interviews,workshops, email, questionnaires, or any combination of these. 3.1 Determine Process and System Criticality Step one of the BIA process- Working with input from users, managers, mission/business processowners, and other internal or external points of contact (POC), identifythe specific mission/business processes that depend on or support theinformation system.Mission/Business ProcessDescriptionPay vendor invoiceProcess of obligating funds, issuing check or electronic payment and acknowledging receiptIfcriticality of mission/business processes has not been determinedoutside of the BIA, the following subsections will help to determinecriticality of mission/business processes that depend on or support theinformation system.3.1.1 Identify Outage Impacts and Estimated Downtime Thissection identifies and characterizes the types of impact categoriesthat a system disruption is likely to create in addition to thoseidentified by the FIPS 199 impact level, as well as the estimateddowntime that the organization can tolerate for a given process. Impactcategories should be created and values assigned to these categories inorder to measure the level or type of impact a disruption may cause. Anexample of cost as an impact category is provided. Organizations couldconsider other categories like harm to individuals and ability toperform mission. The template should be revised to reflect what isappropriate for the organization.Outage ImpactsImpactcategories and values should be created in order to characterize levelsof severity to the organization that would result for that particularimpact category if the mission/business process could not be performed.These impact categories and values are samples and should be revised toreflect what is appropriate for the organization. The following impact categories represent important areas for consideration in the event of a disruption or impact.Impact category: {insert category name}Impact values for assessing category impact:Severe = {insert value}Moderate = {insert value}Minimal = {insert value} The table below summarizes the impact on each mission/business process if {system name}were unavailable, based on the following criteria:Mission/Business ProcessImpact Category{insert}{insert}{insert}{insert}ImpactPay vendor invoiceEstimated DowntimeWorkingdirectly with mission/business process owners, departmental staff,managers, and other stakeholders, estimate the downtime factors forconsideration as a result of a disruptive event.Maximum Tolerable Downtime (MTD). TheMTD represents the total amount of time leaders/managers are willing toaccept for a mission/business process outage or disruption and includesall impact considerations. Determining MTD is important because itcould leave continuity planners with imprecise direction on (1)selection of an appropriate recovery method, and (2) the depth of detailwhich will be required when developing recovery procedures, includingtheir scope and content. Recovery Time Objective (RTO).RTO defines the maximum amount of time that a system resource canremain unavailable before there is an unacceptable impact on othersystem resources, supported mission/business processes, and the MTD.Determining the information system resource RTO is important forselecting appropriate technologies that are best suited for meeting theMTD.Recovery Point Objective (RPO). The RPOrepresents the point in time, prior to a disruption or system outage, towhich mission/business process data must be recovered (given the mostrecent backup copy of the data) after an outage. The table below identifies the MTD, RTO, and RPO (as applicable) for the organizational mission/business processes that rely on {system name}. Valuesfor MTDs and RPOs are expected to be specific time frames, identifiedin hourly increments (i.e., 8 hours, 36 hours, 97 hours, etc.).Mission/Business ProcessMTDRTORPOPay vendor invoice72 hours48 hours12 hours (last backup)Includea description of the drivers for the MTD, RTO, and RPOs listed in thetable above (e.g., mandate, workload, performance measure, etc.).Includea description of any alternate means (secondary processing or manualwork-around) for recovering the mission/business process(es) that relyon the system. If none exist, so state.3.2 Identify Resource RequirementsThe following table identifies the resources that compose {system name} including hardware, software, and other resources such as data files.System Resource/ComponentPlatform/OS/Version (as applicable)DescriptionWeb Server 1Optiplex GX280Web Site HostItis assumed that all identified resources support the mission/businessprocesses identified in Section 3.1 unless otherwise stated. Note:Information for this section should be available from the system’sSystem Security Plan (SSP) and can be copied from the SSP, or referencethe applicable section in the SSP and attach the latest version of theSSP to this contingency plan.3.3 Identify Recovery Priorities for System ResourcesThe table below lists the order of recovery for {system name}resources. The table also identifies the expected time for recoveringthe resource following a “worst case” (complete rebuild/repair orreplacement) disruption.Recovery Time Objective (RTO)- RTO defines the maximum amount of time that a system resource canremain unavailable before there is an unacceptable impact on othersystem resources, supported mission/business processes, and the MTD.Determining the information system resource RTO is important forselecting appropriate technologies that are best suited for meeting theMTD.PrioritySystem Resource/ComponentRecovery Time ObjectiveWeb Server 1Optiplex GX28024 hours to rebuild or replaceAsystem resource can be software, data files, servers, or other hardwareand should be identified individually or as a logical group. Identifyany alternate strategies in place to meet expected RTOs. This includesbackup or spare equipment and vendor support contracts.I NEED THE REFERENCES TOO