BIA: what a Business Impact Analysis is

In short

A BIA answers a question that is easy to ask and hard to dodge: "how long can we do without this activity?". The answer is different for every process. Invoicing can wait a few days, order dispatch perhaps a few hours, a customer support switchboard a few minutes. It is the first step of any business continuity plan and, in ISO 22301, an explicit requirement.

How it works

1. List of processes and the products or services they support.
2. Impacts over time: for each process you estimate what happens after an hour, a day, a week of downtime, in financial, contractual, legal, reputational and operational terms.
3. Maximum tolerable period of disruption (often called MTPD), beyond which the damage becomes unacceptable.
4. Recovery objectives: from these you derive the RTO and RPO of each process and of the systems that support it.
5. Dependencies: people, applications, data, sites and suppliers without which the process does not work.
6. Priorities: the order of recovery, written down before the emergency.

Why it matters

Without a BIA, the recovery plan rests on impressions, and in an emergency everyone considers their own system urgent. The BIA provides a shared criterion, approved by management. It is different from risk analysis: the BIA measures the consequences of a disruption, whatever the cause; risk analysis estimates the likelihood and impact of individual threats. Each feeds the other. They are required, in different forms, by NIS2 (business continuity and crisis management), ISO/IEC 27001 and the DORA regulation for the financial sector.

Example

A food distribution company analyses its processes. It finds that receiving orders from supermarkets, which come in through a portal by 2 p.m., is the most critical process: half a day of downtime means perishable goods not delivered, and penalties. The maximum tolerable period is four hours, and the warehouse depends on the same server and on a single connectivity provider. The BIA leads to two decisions: a second internet line, and a manual procedure for receiving orders by email if the portal goes down.

Related terms

• RTO and RPO
• Business continuity
• Residual risk
• Supply chain attack