After reading, you can run a BIA with activity owners and derive recovery targets the business will defend.
Definition
Clause 8.2.2 of ISO 22301 asks you to define the types of impact, assess them over time, identify the activities that support priority products and services, and set the time frame in which each must resume.
NIST SP 800-34 follows three steps: determine processes and their recovery criticality, identify the resources they need, and identify recovery priorities.
Why it matters
Without a BIA, recovery budgets tend to follow whoever argues the loudest. With one, the money goes to what would actually hurt.
Every recovery target in every later plan comes from this work.
How it works
List the activities with their owners, and choose the types of impact that count for you: financial, customer, legal, reputation, safety.
For each activity, estimate the impact at steps such as 4 hours, 1 day, 3 days and 1 week. From that curve you can read the point where the damage becomes unacceptable, then set the recovery time and recovery point objectives.
Note what each activity needs to run: people, systems, data, suppliers, sites. Management then approves the results, because they set priorities across departments.
A worked case
Invoicing at a wholesaler: no impact for 2 days, late payments from day 3, a cash problem after day 7. The company can tolerate 5 days at most and sets a recovery objective of 3.
Order taking looks very different, with €40,000 of sales lost per day from the first hour. It can tolerate 8 hours and gets an objective of 4, which puts it first in line for the recovery budget.
Good practices
- Interview the people who run each activity. They know the workarounds nobody wrote down.
- Use figures from finance wherever you can.
- Allow for peak periods: an outage in the week of month end is another event altogether.
- Record dependencies on suppliers and on other departments.
Common mistakes
- Rating every activity as critical. Owners are defending their teams, and the result prioritises nothing.
- Basing objectives on what IT can do today, when the point is to learn what the business needs.
- Confusing the BIA with a risk assessment. It looks at consequences, whatever the cause.
- Letting one person guess the impacts for every department.
Questions
- What is the difference between a BIA and a risk assessment?
- A BIA asks what happens if an activity stops. A risk assessment asks what could stop it and how likely that is.
- What is the maximum tolerable period of disruption?
- The time after which the impact of not resuming becomes unacceptable. ISO 22301 clause 8.2.2 asks for this time frame, and the recovery time objective is set within it.
- Who approves a BIA?
- Top management, because it sets priorities and funding across departments.
- How many time steps should a BIA use?
- Usually four to six, closer together at the start, where the impact changes fastest.
- Can a BIA be done without workshops?
- A questionnaire can collect first answers, but impacts still need discussing with owners and comparing between departments.