(1) An assessment made to differentiate between critical and non-critical business functions in order to determine the acceptability of disruption to business functions in the context of the costs of establishing alternative solutions. NOTE: A function may be considered critical if dictated by law.
(2) Management’s analysis of an entity’s requirements, functions, and interdependencies used to characterize contingency needs and priorities in the event of a disruption. Adapted from: FFIEC Business Continuity Management Handbook. 2021. https://ithandbook.ffiec.gov/it-booklets/business-continuity-management.aspx