Page 228 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

assessment identifies the likelihood that each risk will occur. To keep
calculations consistent, this assessment is usually expressed in terms

of an annualized rate of occurrence (ARO) that reflects the number of
times a business expects to experience a given disaster each year.

The BCP team should sit down and determine an ARO for each risk
identified in the previous section. These numbers should be based on
corporate history, professional experience of team members, and
advice from experts, such as meteorologists, seismologists, fire

prevention professionals, and other consultants, as needed.

In addition to the government resources identified in this

chapter, insurance companies develop large repositories of risk
information as part of their actuarial processes. You may be able to

obtain this information from them to assist in your BCP efforts.
After all, you have a mutual interest in preventing damage to your
business!

In many cases, you may be able to find likelihood assessments for
some risks prepared by experts at no cost to you. For example, the U.S.
Geological Survey (USGS) developed the earthquake hazard map
shown in Figure 3.1. This map illustrates the ARO for earthquakes in
various regions of the United States. Similarly, the Federal Emergency

Management Agency (FEMA) coordinates the development of detailed
flood maps of local communities throughout the United States. These
resources are available online and offer a wealth of information to
organizations performing a business impact assessment.