Business impact analysis

A business impact analysis (BIA) identifies which business functions and processes are actually critical, and what depends on them: which people, systems, suppliers, and facilities each function needs to operate.

What a BIA looks at

• Which functions would cause the most serious harm if disrupted, financially, operationally, legally, or reputationally.
• How that harm grows the longer the disruption continues, which is exactly what feeds into setting a realistic RTO.
• What each critical function actually depends on to run, which is often more interconnected and less obvious than people assume until they map it out properly.

The output of a BIA is a prioritised list: which functions need to be recovered first, second, and so on, backed by a clear reason why, rather than a guess made under pressure during an actual incident.