CISO Assistant Assets & Business Impact assesments

In CISO Assistant, managing your organizational footprint involves transforming a flat inventory into an interconnected dependency map. The platform divides assets into business-critical functions (Primary Assets) and the underlying technology stack (Supporting Assets). This distinction forms the baseline for conducting a Business Impact Analysis (BIA) to determine your recovery priorities.

1. Asset Classification & Directory Structure

To maintain data separation across different organizational divisions, assets are strictly categorized and nested inside dedicated Folders or Domains.1

• Primary Assets (PR): Core business values, critical workflows, or highly regulated information (e.g., Patient Health Records, Customer PII, Intellectual Property, Financial Transaction Logs).1

• Supporting Assets (SP): The enabling technology, infrastructure, or physical nodes that house, process, or transmit your primary assets (e.g., Cloud Databases, AWS/Azure Infrastructure, CI/CD Pipelines, Identity Providers).1

Onboarding Assets via the Data Wizard

You can populate your inventory directly through single-sheet Excel or CSV ingestion scripts using the Data Wizard. Ensure your sheet tracks these core fields:1

• name (Required): Unique string identifying the asset.

• type: Explicitly declared as PR or SP (defaults to SP if blank).

• domain: The target folder name lookup to map organizational boundary scoping.

• parent_assets: Comma- or pipe-separated reference IDs to establish underlying infrastructure hierarchies.

2. Formulating the Dependency Tree (Linkage Logic)

An effective asset management program relies on Dependency Mapping rather than treating assets as isolated entries. You map business workflows to technical assets to see exactly what stops working if a system goes down:1

   [Primary Asset: PR] ──(Linked To)──► [Supporting Asset: SP]

(e.g., Transaction Processing)         (e.g., AWS Production Database)

By linking structural components together (using the parent_assets field during spreadsheet import or via the UI), CISO Assistant automatically propagates vulnerability data and configuration gaps up to the parent business functions.

3. Conducting a Business Impact Assessment (BIA)

The Business Impact Analysis features in CISO Assistant use a multi-sheet import format (combining Summary, Asset Assessments, and Thresholds) to establish recovery objectives and clear escalation boundaries.

Sheet 1: The Summary Layer

Defines the main BIA campaign boundary, linking your continuity study to a specific deployment boundary:

• name (Required): The title of the BIA campaign.

• perimeter: The specific target Perimeter lookup being evaluated.

• due_date / eta: Hard deadlines for your team to finalize the continuity parameters.

Sheet 2: The Asset Assessment Matrix

This sheet maps every asset within the scope of the BIA to its explicit operational capabilities:

• asset: The unique asset name or internal reference code.

• recovery_documented / recovery_tested: Boolean flags (true/false) tracking whether a valid Disaster Recovery (DR) runbook exists and has been actively tested.

• recovery_targets_met: Confirms if your actual capability satisfies standard operational requirements.

Sheet 3: Escalation Thresholds (Point-in-Time Metrics)

This sheet lets you plot potential business impact across specific downtime intervals (e.g., 1 hour, 4 hours, 24 hours):

• point_in_time: Integer field mapping the downtime milestone index.

• quali_impact: Integer index mapping directly to your active Risk Matrix impact rows (automatically validated against your matrix limits to block corrupted formatting inputs).

• quanti_impact: Numeric decimal field tracking real financial or revenue loss over time.

> **System Integration Rule:** If a threshold row is imported for a BIA/asset pair that doesn't have an asset assessment record yet, CISO Assistant's backend will automatically generate the missing container. This allows your team to upload threshold data directly without needing to pre-stage placeholder records.

4. Post-BIA Validation via X-Rays

Once your asset inventories and BIA metrics are imported into the database, use the platform's X-Rays automated quality assurance engine to check your data health:1

• Orphaned Assets Check: Checks for primary assets that aren't mapped to supporting assets or risk scenarios.1

• Risk Logic Alignment: Ensures that when you create risk scenarios for your new assets (using the naming convention [Threat] on [Asset]), the residual risk score calculated by your controls doesn't exceed the inherent current threat level.1

RTO and RPO Configuration Checklist for Asset Assessments

This checklist provides a structured framework for configuring Recovery Time Objective (RTO) and Recovery Point Objective (RPO) parameters within the CISO Assistant Business Impact Analysis (BIA) module. Use this reference to properly align technical thresholds with business continuity mandates before executing a multi-sheet spreadsheet ingestion.1

1. Baseline Recovery Definitions

• Recovery Time Objective (RTO): The maximum tolerable duration of downtime before a business function or supporting infrastructure node must be fully restored to operation.

• Recovery Point Objective (RPO): The maximum tolerable data loss interval, measured backward in time from the point of failure, defining your data backup frequency mandates.

2. Asset Assessment Configuration (<BIA name> Sheet)

When configuring the row entry for each asset in the main assessment worksheet, ensure the following core configuration states are explicitly tracked:

• asset Identification: Ensure the asset name precisely matches your master repository naming syntax or uses its specific asset_ref_id lookup to avoid entry duplication.

• recovery_documented State: Mark as true only if a validated Disaster Recovery (DR) runbook, automated backup routine, or technical restoration script actively exists for this specific asset.

• recovery_tested State: Mark as true only if a formal tabletop drill, mock recovery scenario, or automated partition switch has been successfully conducted within the designated testing window.

• recovery_targets_met State: Enforce a strict binary verification. Mark as true if your actual proven technical capability (e.g., a 2-hour recovery script) comfortably satisfies the operational business requirements.

• dependencies Mapping: Document all underlying component mappings by listing dependent supporting assets as a comma-separated string to ensure vulnerability and outage data propagate accurately up the tree structure.

3. Escalation Threshold Mapping (<BIA name> - thresholds Sheet)

To plot potential operational and financial impacts over increasing downtime intervals, map point-in-time metrics cleanly across your risk rows:

• point_in_time Milestone Calibration: Establish clear integer indices representing critical time horizons (e.g., Index 1 = 1 Hour, Index 2 = 4 Hours, Index 3 = 24 Hours).

• quali_impact Score Verification: Input an integer index mapping directly to an active impact level in your perimeter's selected Risk Matrix.> **Critical System Rule:** The ingestion engine automatically validates this value against your matrix boundaries. Any value outside the allowed `[0, n_impacts - 1]` range will instantly trigger a row-level parsing error to block corrupt inputs from fouling database integrity.

• quanti_impact Financial Tracking: Input a precise decimal field modeling real-world revenue loss, regulatory fines, or operational cost overruns across that specific time horizon.

• quanti_impact_unit Baseline: Ensure this defaults to standard "currency" mapping to match the financial thresholds of your central corporate registers.

4. Post-Import Quality Assurance via X-Rays

Following a successful data ingestion pass, always review the health of your configuration metadata using the system's automated check engine:

• Review Threshold Dependencies: Verify that any AssetAssessment container automatically created by a threshold-only pass has been properly populated with its missing owner and operational context tags.

• Audit Continuity Alignment: Check for X-Ray Warning indicators flagging critical primary assets that lack any linked supporting assets, as a risk scenario cannot be accurately calculated if its technical dependencies are unmapped.

To execute your Business Impact Analysis (BIA) configuration seamlessly via the command line, use the CLICA utility. This interface leverages the same backend validation engine that powers the enterprise web UI, ensuring your RTO and RPO metrics are safely ingested into your database.

1. Ingestion Protocol Syntax

The BIA module expects a multi-sheet Excel package matching your target configuration rules. You can execute the data load using either a direct UUID string or a human-readable folder look-up name:1

# Execute the BIA multi-sheet import sequence

uv run clica.py import-bia --file business-continuity-metrics.xlsx

2. Creating an Empty Template Outline via the CLI

To inspect or generate a clean workbook structure populated with your current perimeters and assets, run the dynamic query engine from the repository root:

# 1. Retrieve the list of active perimeters to gather your exact scope name

uv run clica.py get-perimeters

# 2. Extract active assets from your target scope to map into your rows

uv run clica.py get-folders

Using these returned structural maps, you can populate the three required sheets (Summary, <BIA name>, and <BIA name> - thresholds).1

3. Execution Verification Pipeline

Once the CLI returns a success payload, always run a status check to ensure your information architecture is perfectly aligned:1

# Verify model object balances and inventory totals

python manage.py status

Finally, log back into the web portal and navigate directly to the /x-rays dashboard. The X-Rays Engine will automatically run its PerimeterViewSet.quality_check() routine on the backend to flag any newly created asset containers that lack operational owners or reference controls, keeping your data quality audit-ready.1