What is impact analysis?
Impact analysis, often called change impact analysis, is the assessment done before a change is approved to predict everything the change will touch and how badly things could go if it fails. The change owner usually writes it, with input from technical reviewers, and attaches it to the change request. Its result is a risk rating that sets how much testing the change needs and who has to sign off on it.
Questions an impact analysis answers
A good analysis is short and specific. It names every system the change touches directly and every system that depends on those, such as a reporting server that reads from the database being upgraded. It estimates how likely the change is to fail and what a failure would cost the business. It records the security side: new open ports, new access, changes to what gets logged, or a control turned off while the work runs. It states the expected downtime and whether the change can be reversed cleanly. And it weighs the risk of not making the change, because delaying a patch for an exploited internet-facing flaw can be riskier than a short outage.
Example: upgrading a domain controller
An administrator proposes moving a domain controller to a newer Windows Server release. The analysis finds three things. An old badge-printing application authenticates with a legacy protocol that the new build disables by default. Two branch offices fall back to this controller when their local one is down. And the upgrade needs a reboot. The rating comes out medium. The plan adds a staging test of the badge application, books the reboot into the Sunday window and warns the branch managers. Without the analysis, the first sign of trouble would have been a lobby unable to print visitor badges on Monday morning.
Impact analysis vs. business impact analysis
The names are close, but they belong to different processes.
| Impact analysis | Business impact analysis (BIA) | |
|---|---|---|
| Process | Change management | Business continuity planning |
| Question | What could this one change affect or break? | What happens to the business if a critical function stops, and how quickly? |
| Output | A risk rating, approval route and test plan for the change | MTD, RTO and RPO targets for each function |
| When | Before each significant change | Periodically, across the organization |
Where it fits in the change process
Impact analysis happens during assessment, after the request for change is submitted and before the change advisory board reviews it. It sits beside the test results and the backout plan, and the three together are the evidence approvers rely on. A request that reaches the board without them should be sent back. Standards expect it: NIST SP 800-53 has impact analyses as a control of its own (CM-4) in the configuration management family, and PCI DSS asks for the security impact of changes to in-scope systems to be documented.
Impact analysis on the CompTIA Security+ exam
Impact analysis is one of the change management business processes in SY0-801 objective 1.2. Scenario wording such as determining which systems a change could affect, finding dependencies before approval, or assessing the risk of an upgrade points to it. When a change breaks a system nobody expected, the missing step was usually the impact analysis. The main distractor is business impact analysis, which belongs to continuity planning rather than a single change. Others are test results, which prove a change works rather than predict its reach, and the backout plan, which describes how to undo it.