How do you identify critical business functions during a disaster?

I can only concur with the previous answer - identifying critical Business functions DURING hard times is to late. Identifying important services is covered by many methodologies but what one should really know is the major core function of the business - that service a System should return to when overcoming a crisis. A public transportation company should carry people/goods... A university should educate and do research... A hospital should treat people...

The short answer is you don’t. You’ve assessed all of these things before disaster strikes, written your response plans and playbooks and exercised them. The one thing you ABSOLUTELY DON’T DO is make it up on the fly during the disaster event

I'll take a different approach in my response because the, "You should have prioritised and developed/tested/verified your critical functions BEFORE the disaster" doesn't help clients that don't already have a Business Continuity Management Program in place. Start by basing your functional recovery prioritisation on the KNOWN consequences "hurts" of not having your services/functions operating within a certain period (RTO). Because you're in this situation, you haven't done the analysis - so go by what is hurting now and what you know is going to start hurting. Addressing/stopping those known hurts should buy a "little breathing room" to figure out next steps. Get ahead of new hurts before they come - they going to come quick!

Identifying critical business functions during a disaster involves assessing various factors and assessing business objectives. A structured approach includes Business Impact Analysis (BIA), Dependency Mapping, Criticism Assessment, Business Objectives Alignment, Resource Dependencies, Scenario Planning, and continuity Planning. BIA involves assessing the financial, operational, legal, regulatory, and reputational impacts of disruptions, dependency mapping, criticality assessment, alignment with business objectives, evaluating resource dependencies, conducting scenario planning exercises, and developing continuity plans and recovery strategies for each critical function.

Mapping all critical processes to their dependencies allows you to see that there are key applications and assets that are needed for many processes which can pay dividends later in prioritization. As we all know in a disaster communication is key. By understanding key dependencies practitioners are able to help internal stakeholders to call out specific communication steps in their BCPs whether they are internal comms or external comms which may go unnoticed otherwise. Lastly, understanding all dependencies cross functional testing may be used, and it is easier to integrate plans across functional areas to be more usable in a disaster with realistic testing to encourage developing relationships and limiting faulty assumptions.

As continuity professionals, we rely on the business owners and leaders to provide this information through a business impact analysis (BIA). However, we should assess the BIA responses and identify shared support resources (i.e., technology, vendor, people, facilities) and where/how these resources support critical functions to understand and measure the risk if they become unavailable. Third party vendor risk must be assessed. If one system/application supports several critical functions across the organization and is no longer available (e.g., hacked/cyber, vendor outage, connection loss (your org issue), etc.), continuity strategies (e.g., manual workarounds, MOU/MOA, mitigation) need to be developed with leaders prior to an outage.

Assessing impacts to business operations as a result of a business disruption begins with understanding the organizational mission, what services support accomplishing the mission, and how the organization is structured to deliver the services. Identify senior business leaders to educate, interview, and gain support to complete a business impact analysis. Have specific objectives for initial conversations; identify business functions and owners who will later provide more information, such as resources needed to support performance of a function. Remember, the people completing this task do not speak and live business continuity, so always educate and deliver assignments in bite size chucks that are easy to digest. Good luck!

You’re going to do this in the midst of a disaster? Updating your resume would be a much more valuable use of your time at this moment.

Enable leaders and key member of the team to act and operate independently. Then there is no need to prioritize functions. Have an incident response team that can help deploy resources and provide support but don’t box everyone into a set method or priority because it is sure to change when the event happen and get modified many times thereafter.

Analyzing the prioritized functions and establishing and practicing recovery strategies is the foundation to response and recovery planning, which should be obtained through a business impact analysis of all business areas across the organization. If this has not been completed, doing so DURING an emergency response is NOT the time to do it. Without knowing which business areas perform critical functions, you are just putting out fires and responding to what's directly in front of you, without a map to guide you in the right direction. For example: - If your website is down, how do you determine which areas need restored first? - Which functions must be restored quickly to avoid financial or legal penalties and who needs notified?

Having been involved in hundreds of actual event responses, I strongly urge anyone who reads it to promptly ignore this guidance. Build team capabilities and ensure they understand and support the mission. You’d be surprised at what a small band of passionate, capable people can do under very challenging circumstances.

You identify them *in *advance* by doing a proper Business Impact Analysis. That tells you which business lines get priority, so your plans and resource allocations reflect necessity.

Here comes the importance of contingency planning/ERP emergency response plan and mock drills. It’s very essential that mock drills and full scale mock drills are conducted as per the laid down periodicity.The outcome of mock drills need to be assessed and remedial measures/corrective actions taken. It’s equally important to update the ERP/ CP from time to time to remove redundant/outdated processes and procedures.