[BCM] [Damanat] [E2] [C4] [P5] Business Impact Analysis

Part 14: Identifying Minimum Personnel Requirements

People are the most critical resource in the successful recovery of any organisation.

Regardless of how resilient Damanat's facilities, technology and systems may be, business recovery cannot be achieved without competent personnel possessing the authority, skills and experience necessary to perform essential activities.

The Business Impact Analysis (BIA) should therefore determine not only the minimum number of staff required but also the competencies, delegated authorities and succession arrangements needed to sustain each Critical Business Function (CBF) during disruption.

When assessing personnel requirements, Damanat should consider:

• Minimum staffing levels required to achieve the approved Minimum Business Continuity Objective (MBCO).
• Specialist technical knowledge.
• Delegated financial and operational approval authority.
• Availability of alternate personnel.
• Cross-training arrangements.
• Segregation of duties.
• Shift arrangements for prolonged incidents.
• Staff welfare and fatigue management.
• Remote-working suitability.
• Maximum sustainable recovery staffing period.

The objective is to recover essential business capability rather than restore the full workforce immediately.

Table BIA 4.9: Minimum Personnel Requirements

Competence Before Headcount

The BIA should recognise that recovery capability depends more on competence than on total staff numbers. A larger workforce without the appropriate knowledge, delegated authority or technical expertise may be less effective than a smaller, well-trained recovery team.

Accordingly, Damanat should ensure that:

• Critical decision-making authority is delegated appropriately.
• Specialist knowledge is documented.
• Cross-training programmes are implemented.
• Successors are identified for key positions.
• Recovery teams participate regularly in BCM exercises.

Part 15: Identifying Supporting Technology Requirements

Nearly every Critical Business Function performed by Damanat depends on technology.

Consequently, the Business Impact Analysis should identify the ICT systems, applications and infrastructure necessary to support business recovery. Technology recovery priorities should always be derived from business recovery requirements rather than determined independently by ICT.

Technology dependency analysis should consider:

• Business applications.
• Databases.
• Network infrastructure.
• Internet connectivity.
• Telecommunications.
• Cloud services.
• Identity and access management.
• Multi-factor authentication.
• Cybersecurity monitoring.
• Backup and replication.
• End-user devices.
• Collaboration platforms.
• Vendor support arrangements.

Table BIA 4.10: Supporting Technology Requirements

Technology Recovery Principles

The supporting technology assessment should demonstrate that:

• Business priorities determine ICT priorities.
• Critical systems are recovered before dependent applications.
• Supporting infrastructure is restored before end-user services.
• Technology recovery objectives are validated through Disaster Recovery testing.
• Supplier service levels align with business recovery requirements.

Part 16: Identifying Vital Records and Information Requirements

Information is a critical organisational asset. Without access to accurate, complete and reliable information, Damanat would be unable to process mortgage guarantees, demonstrate regulatory compliance or make informed management decisions. The BIA should therefore identify the vital records required to support each CBF and define how they will be protected and recovered during disruption.

Vital records should be assessed according to:

• Confidentiality.
• Integrity.
• Availability.
• Retention requirements.
• Evidential value.
• Secure backup arrangements.
• Version control.
• Alternate access methods.

Table BIA 4.11: Vital Records and Information Requirements

Information Governance Considerations

Each vital record should have:

• A designated owner.
• Defined retention requirements.
• Secure storage arrangements.
• Recovery procedures.
• Backup schedules.
• Access controls.
• Encryption where appropriate.
• Periodic restoration testing.

Part 17: Identifying Internal Dependencies

No Critical Business Function operates independently.

The BIA should identify how business functions rely upon one another to deliver Damanat's services.

Understanding these internal dependencies enables management to identify shared resources, single points of failure and enterprise-wide recovery priorities.

Table BIA 4.12: Internal CBF Dependency Matrix

Managing Internal Dependencies

Dependency analysis should identify:

• Shared ICT platforms.
• Shared personnel.
• Shared facilities.
• Shared suppliers.
• Shared information repositories.
• Shared approval authorities.

These shared dependencies often become enterprise-wide recovery priorities because disruptions affect multiple CBFs simultaneously.

The next instalment will cover:

• Part 18: External Dependency Assessment
• Part 19: Facility and Recovery-Location Requirements
• Part 20: Manual Workaround Assessment
• Part 21: Backlog and Catch-Up Assessment