What is a business impact analysis?
A business impact analysis (BIA) is the process of identifying an organization's critical business functions, the resources each one depends on, and how the harm from losing each function grows the longer it is unavailable. It asks what happens if a function stops, regardless of why it stopped: a ransomware attack, a fire, a cloud outage or a key supplier going out of business. The answers set the recovery priorities and targets that business continuity and disaster recovery plans are built on.
What a BIA produces
- A list of critical functions, ranked by how quickly their loss causes serious harm.
- Dependencies for each function: systems, applications, data, people, facilities and suppliers. Mapping them often exposes single points of failure.
- Impact over time, across categories such as financial loss, regulatory or contractual penalties, reputational damage, operational disruption and safety.
- Maximum tolerable downtime (MTD): the longest a function can be unavailable before the harm becomes unacceptable. Some standards call it the maximum tolerable period of disruption.
- Recovery time objective (RTO): how quickly each supporting system must be restored. It has to fit inside the MTD.
- Recovery point objective (RPO): how much data loss, measured in time, is acceptable, which drives backup and replication frequency.
How a BIA is carried out
- Define the scope and get executive sponsorship, since the BIA needs time from every business unit.
- Identify the business functions and their owners.
- Interview owners or send questionnaires about dependencies, peak periods and the impact of outages of increasing length.
- Estimate impacts in money where possible, and qualitatively where not.
- Set the MTD, RTO and RPO for each function and its systems, and rank recovery priorities.
- Have leadership approve the results, then review the BIA on a schedule, commonly yearly, and after major changes such as new systems, acquisitions or relocations.
NIST SP 800-34 describes the BIA as a step in contingency planning for federal information systems, and ISO 22301 includes it in business continuity management.
Example: an online order system
| Outage length | Impact on online orders |
|---|---|
| 1 hour | About $15,000 in lost sales; customers retry later |
| 8 hours | About $120,000 lost; complaints and social media attention |
| 24 hours | Contractual penalties with marketplace partners begin |
| 3 days | Customers move to competitors; lasting reputational harm |
The business owner sets the MTD at 24 hours. Restoring the order platform takes about 4 hours of technical work, and staff then need time to verify orders and reconcile payments, so IT is given an RTO of 8 hours, which leaves room inside the MTD. Because re-entering lost orders is costly, the RPO is 15 minutes, which nightly backups can't meet, so the design needs frequent snapshots or database replication. Each figure traces back to the BIA, so when an auditor asks why the order system recovers before the intranet, the BIA is the answer.
BIA vs. risk assessment vs. BCP
- Risk assessment asks what could disrupt the business and how likely it is. The BIA asks how bad a disruption would be over time, whatever the cause. Together they supply likelihood and impact.
- Business continuity plan (BCP) describes how the business keeps operating during a disruption. It is built from the BIA's priorities.
- Disaster recovery plan (DRP) describes how IT systems and data are restored, using the BIA's RTO and RPO targets.
- Risk register tracks identified risks, owners and treatments, and the BIA supplies the impact side of many entries.
Business impact analysis on the CompTIA Security+ exam
On SY0-801, the BIA belongs to objective 5.2, which covers risk management processes, and it supports the business continuity and disaster recovery plans in objective 5.1. Questions often ask which document determines recovery priorities, why one system's RTO is shorter than another's, or how to identify the functions the organization can't afford to lose; the answer is the BIA. Distractors include the risk register, which tracks risks rather than downtime tolerance, the BCP and DRP, which record and carry out the targets but don't determine them, and a risk assessment, which focuses on threats and likelihood. Keep the relationship in mind: the BIA sets MTD, RTO and RPO, and every RTO must fit within the MTD.