Business impact analysis

A business impact analysis (BIA) measures the operational, financial and reputational consequences of disrupting specific assets or business processes. Where a risk assessment asks “what could go wrong?”, a BIA asks “if it does, how bad is it, and how quickly does it become unacceptable?”. The output is a prioritized view of which assets your continuity plan must protect first.

Where to find it

Assets management → Business Impact Analysis in the sidebar.

Key concepts

Studies and BIA assessments

A BIA is a study scoped to a perimeter. Click the add button, give the study a Name, pick the perimeter and set its Status (planned, in progress, in review, done…). Inside the study you add one BIA assessment per asset in scope — the resiliency assessment of that asset.

Impact over time

The heart of each BIA assessment is the Impact over time view. Instead of a single severity score, you record how the impact of a disruption escalates as the outage lasts: acceptable for the first hours, serious after a day, critical after a week. Each escalation threshold pairs a duration with an impact level, so the curve shows exactly when a disruption crosses from tolerable to unacceptable.

This is where the disaster-recovery objectives you set on assets — RTO, RPO and MTD — meet reality: the thresholds justify (or challenge) the recovery targets the asset claims to need. See Assets for where those objectives live.

Working with a BIA

1. Create the study and attach the assets that support the business process under analysis.
2. For each asset, open its BIA assessment and define escalation thresholds across the dimensions that matter — financial loss, operational downtime, regulatory exposure, reputational damage.
3. Review the study’s roll-up to compare assets: the ones whose impact escalates fastest are your recovery priorities.

Action plan

The Action plan tab collects the follow-up work attached to the study — the controls and measures that close the gap between the impact curve and the recovery capability you actually have. Use it to hand continuity findings to the team that runs Applied controls.

Report and visual views

Two presentation views turn the study into something you can circulate:

• The report view assembles the study into a structured document — scope, assessments, thresholds and priorities — ready to export for continuity planning or an audit.
• The visual view renders the impact-over-time curves graphically, which is the fastest way to show leadership where the organization’s tolerance for downtime actually sits.

Tip

Run the BIA before, not after, negotiating recovery targets with service owners. A documented impact curve makes an RTO conversation factual instead of political.

Related

• Assets — the inventory and the RTO/RPO/MTD objectives BIAs validate.
• Asset classes — classify what you are assessing.
• Applied controls — implement the action plan.