which document provides information about the estimated risks and the effects of those risks on the ability of an organization to continue doing business when key processes or technology become unavailable?