Page 229 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide
P. 229
FIGURE 3.1 Earthquake hazard map of the United States
Impact Assessment
As you may have surmised based on its name, the impact assessment
is one of the most critical portions of the business impact assessment.
In this phase, you analyze the data gathered during risk identification
and likelihood assessment and attempt to determine what impact each
one of the identified risks would have on the business if it were to
occur.
From a quantitative point of view, we will cover three specific metrics:
the exposure factor, the single loss expectancy, and the annualized loss
expectancy. Each one of these values is computed for each specific
risk/asset combination evaluated during the previous phases.
The exposure factor (EF) is the amount of damage that the risk poses
to the asset, expressed as a percentage of the asset’s value. For
example, if the BCP team consults with fire experts and determines
that a building fire would cause 70 percent of the building to be
destroyed, the exposure factor of the building to fire is 70 percent.
