Maximum Acceptable Outage

Background

The concept of MAOs came into being with the introduction of the British Standard Institute's BS 25999, published at the end of 2007. The standard requires the dependencies of crucial activities to be identified within organizations. Section 4 of the standard states that the goal of a business impact analysis (BIA) is to determine the impact of a disruption of any activity that supports the organization's key products and services. This is in part achieved through the identification of maximum acceptable outages. The MAO is therefore a key aspect of undertaking a BIA of a business, organization, or service provider, with the intention of determining the impact of a disruption of any activity that supports the organization's key products or services.

Identifying Maximum Acceptable Outage

The MAO assists an organization's management to understand the service itself, as it also adds clarity to the organization's recovery priorities. Understanding the MAO allows management to ensure that proper plans are in place in order to ensure that the customer's maximum tolerance is not exceeded.

Identifying and understanding maximum acceptable outages comprises several stages. The initial stage is to identify the key activities, products, and services of the organization or business. Business continuity managers and business impact analysts must necessarily perform this stage in consultation with the organization's management. All key activities must be considered, whether they are internal or external-facing. The identified key outputs are then prioritized according to their importance to the running of the organization or business. Key products and services are assessed in terms of a variety of demands, including customer expectations, reputational issues, regulatory requirements, strategic consequences, and financial and operational impairment.

Departments, functions, and processes of each key activity, product, and service are then mapped. In performing this mapping activity, the amount of time required to perform activities necessary in order to deliver the product or service to its key stakeholders must be fully understood. This is often referred to as “cycle time.” Organizational data are gathered in order to confirm or refute initial ideas about the MAO and to have detailed comprehensive information about departments, functions, and processes, including cycle times.

The length of time each individual product or service could remain undelivered before the business would experience difficulties must be identified. The MAO will be based on several factors, which may include lost income, public disruption, reputational damage, or regulation compliance issues. At this stage, the recovery time objective (RTO) can be identified. This is the point in time, following a disruption, by which the organization must recover the activity and operations must resume; the MAO is the upper bound on this time.

...