# US 2008/0189154 A1 · Systems and methods for business continuity and business impact analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2008/0189154 A1 - Document ID: US20080189154A1 - Status: Published application - Kind: A1 - Application number: 12/004,021 - Filed: 2007-12-20 - Published: 2008-08-07 - Earliest claimed: 2007-02-02 - Inventors: Robert Wainwright - Web page: https://patentgrep.com/patent/US20080189154A1 ## CPC - G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling - G06Q 10/0631: Resource planning, allocation, distributing or scheduling for enterprises or organisations - G06Q 10/0635: Risk analysis of enterprise or organisation activities - G06Q 10/0639: Performance analysis of employees; Performance analysis of enterprise or organisation operations - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Methods are disclosed for providing business continuity. In one implementation, a business impact analysis method is provided for determining time-critical business units in an organization. The method includes estimating a set of time values for a business unit, the set of time values indicating points of time when a business impact of the business unit will increase, and calculating a resilience impact rating of the business unit based on the estimated time values, wherein the resilience impact rating provides a metric for quantifying a time-criticality of the business unit. The method further includes setting an impact threshold at a specific resilience impact rating value, and identifying the business unit as time-critical business unit if the resilience impact rating is greater than or equal to the impact threshold. ## Claims ### Claim 1 A method for providing business continuity in an organization, the method comprising: identifying risks that can cause a business disruption; developing a response plan for responding to the business disruption based on the identified risks; responding to the business disruption by executing the response plan; and maintaining the response plan during normal business operation, wherein maintaining the response plan comprises performing a business impact analysis using a quantifiable metric to identify time-critical business units in the organization. ### Claim 2 (depends on 1) The method of claim 1, wherein the quantifiable metric comprises resilience impact ratings, and further wherein performing a business impact analysis comprises: identifying business units in the organization; defining levels of impact; estimating a set of time values for each business unit, the set of time values indicating a duration of time from the start of the business disruption to when the business unit would reach at least one of the levels of impact; and calculating an initial resilience impact rating for each business unit based on weighted values of the set of time values. ### Claim 3 (depends on 2) The method of claim 2, wherein performing a business impact analysis further comprises: determining inter-department dependencies for the business units whose initial resilience impact rating is greater than or equal to a criticality threshold; calculating a final resilience impact rating for each business unit based on the inter-department dependencies; identifying each business unit whose final resilience impact rating is greater than or equal to the criticality threshold as a time-critical business unit; and developing the response plan for all time-critical business units based on the final resilience impact rating and the inter-department dependencies. ### Claim 4 (depends on 1) The method of claim 1, wherein the response plan comprises at least one of a crisis management plan, a management summary plan, a department resilience plan, and a system resilience plan which are hierarchically ordered. ### Claim 5 (depends on 4) The method of claim 4, wherein at least one of the crisis management plan, the management summary plan, the department resilience plan, and the system resilience plan comprises an escalation point for executing a hierarchically higher plan. ### Claim 6 (depends on 1) The method of claim 1, further comprising identifying risks that can hinder efficiently responding to the business disruption. ### Claim 7 (depends on 1) The method of claim 1, wherein the response plan includes a recovery time objective. ### Claim 8 (depends on 1) The method of claim 1, further comprising generating an impact portfolio for mapping the business units based on the resilience impact rating and the recovery time objective. ### Claim 9 A system for providing business continuity in an organization, the system comprising: means for identifying risks that can cause a business disruption; means for developing a response plan for responding to the business disruption based on the identified risks; means for responding to the business disruption by executing the response plan; and means for maintaining the response plan during normal business operation, the means for maintaining the response plan comprising means for performing a business impact analysis using a quantifiable metric to identify time-critical business units in the organization. ### Claim 10 (depends on 9) The system of claim 9, wherein the quantifiable metric comprises resilience impact ratings, and further wherein the means for performing a business impact analysis comprises: means for identifying business units in the organization; means for defining levels of impact; means for estimating a set of time values for each business unit, the set of time values indicating a duration of time from the start of the business disruption to when the business unit would reach at least one of the levels of impact; and means for calculating an initial resilience impact rating for each business unit based on weighted values of the set of time values. ### Claim 11 (depends on 10) The system of claim 10, wherein the means for performing a business impact analysis further comprises: means for determining inter-department dependencies for the business units whose initial resilience impact rating is greater than or equal to a criticality threshold; means for calculating a final resilience impact rating for each business unit based on the inter-department dependencies; means for identifying each business unit whose final resilience impact rating is greater than or equal to the criticality threshold as a time-critical business unit; and means for developing the response plan for all time-critical business units based on the final resilience impact rating and the inter-department dependencies. ### Claim 12 (depends on 9) The system of claim 9, further comprising means for identifying risks that can hinder efficiently responding to the business disruption. ### Claim 13 (depends on 9) The system of claim 9, further comprising means for generating an impact portfolio for mapping the business units based on the resilience impact rating and the recovery time objective. ### Claim 14 A business impact analysis method for determining time-critical business units in an organization, the method comprising: estimating a set of time values for a business unit, the set of time values indicating points of time when a business impact of the business unit will increase; calculating a resilience impact rating of the business unit based on the estimated time values, wherein the resilience impact rating provides a metric for quantifying a time-criticality of the business unit; setting an impact threshold at a specific resilience impact rating value; and identifying the business unit as time-critical business unit if the resilience impact rating is greater than or equal to the impact threshold. ### Claim 15 (depends on 14) The business impact analysis method of claim 14, wherein estimating a set of time values comprises: defining multiple levels of increasing impact; and determining a duration of time from the start of a business disruption to when the business unit will reach each of the multiple levels of increasing impact. ### Claim 16 (depends on 14) The business impact analysis method of claim 14, wherein calculating a resilience impact rating further comprises summing weighed values of the set of time values. ### Claim 17 (depends on 16) The business impact analysis method of claim 16, wherein calculating a resilience impact rating is based on the formula: R   I   R = W 1 T 1 + … + W N T N wherein RIR is the resilience impact rating, W1 . . . WN are weights, and T1 . . . TN are the set of time values for N levels of increasing impact. ### Claim 18 (depends on 14) The business impact analysis method of claim 14, further comprising developing a response plan based on the resilience impact rating of the time-critical business unit. ### Claim 19 (depends on 14) The business impact analysis method of claim 14, further comprising developing a response plan based on inter-department dependencies. ### Claim 20 (depends on 14) The business impact analysis method of claim 14, further comprising maintaining a response plan for the time-critical business unit for responding to the business disruption. ### Claim 21 A business impact analysis system for determining time-critical business units in an organization, the system comprising: means for estimating a set of time values for a business unit, the set of time values indicating points of time when a business impact of the business unit will increase; means for calculating a resilience impact rating of the business unit based on the estimated time values, wherein the resilience impact rating provides a metric for quantifying a time-criticality of the business unit; means for setting an impact threshold at a specific resilience impact rating value; and means for identifying the business unit as time-critical business unit if the resilience impact rating is greater than or equal to the impact threshold. ### Claim 22 (depends on 21) The business impact analysis system of claim 21, wherein the means for estimating a set of time values comprises: means for defining multiple levels of increasing impact; and means for determining a duration of time from the start of a business disruption to when the business unit will reach each of the multiple levels of increasing impact. ### Claim 23 (depends on 21) The business impact analysis system of claim 21, wherein the means for calculating a resilience impact rating further comprises means for summing weighed values of the set of time values. ### Claim 24 (depends on 23) The business impact analysis system of claim 23, wherein the means for calculating a resilience impact rating calculates a resilience impact rating based on the formula: R   I   R = W 1 T 1 + … + W N T N wherein RIR is the resilience impact rating, W1 . . . WN are weights, and T1 . . . TN are the set of time values for N levels of increasing impact. ### Claim 25 (depends on 21) The business impact analysis system of claim 21, further comprising means for developing a response plan based on the resilience impact rating of the time-critical business unit.