Update BIA HB Page - Align with Current-State

Why is this change being made?

💡 Provide a detailed answer to the question on why this change is being proposed, in accordance with our value of Transparency.

What:

• Removed references to creating BIA Observations (Tier 3 Information System risks).
  • This includes in the 'TS Add Tracking Issue' Template.
• Removed questions in FY24 Business Impact Analysis (BIA) - Standard unrelated to Critical System Tiering (CST).

Why:

• The current-state BIA program enables the following:

  • Helps determine the systems critical to serving GitLab’s Customers
  • Helps determine the prioritization of system restoration efforts in the event of a disruption

  A System's CST reflects the above and is recorded in the Tech Stack.

• The current-state BIA program is not at the appropriate level of maturity to enable efficient creation of BIA Observations. For example, the current-state program does not have a Single Source of Truth for BIA data.

• In the interim, I believe our team helping implement Okta SSO configuration for New Systems (during onboarding) is a significant value-add. It also mitigates the Access Management risk.

  • Thus, I created Modify 'Tech Stack - Add New System' MR Template and added an Okta SSO step.
    • Slack conversation with IT/BT is here.

Author and Reviewer Checklist

Please verify the check list and ensure to tick them off before the MR is merged.

• Provided a concise title for this Merge Request (MR)
• Added a description to this MR explaining the reasons for the proposed change, per say why, not just what
  • Copy/paste the Slack conversation to document it for later, or upload screenshots. Verify that no confidential data is added, and the content is SAFE
• Assign reviewers for this MR to the correct Directly Responsible Individual/s (DRI)
  • If the DRI for the page/s being updated isn’t immediately clear, then assign it to one of the people listed in the Maintained by section on the page being edited
  • If your manager does not have merge rights, please ask someone to merge it AFTER it has been approved by your manager in #mr-buddies
  • The when to get approval handbook section explains the workflow in more detail
• For transparency, share this MR with the audience that will be impacted.
  • Team: For changes that affect your direct team, share in your group Slack channel
  • Department: If the update affects your department, share the MR in your department Slack channel
  • Company: If the update affects all (or the majority of) GitLab team members, post an update in #whats-happening-at-gitlab linking to this MR
    • For high-priority company-wide announcements work with the internal communications team to post the update in #company-fyi and align on a plan to circulate in additional channels like the "While You Were Iterating" Newsletter

---