Business Impact Analysis (BIA) is a structured analytical process that identifies critical business functions, quantifies the consequences of their disruption, and establishes recovery priorities and time objectives. BIA answers three foundational questions: Which business processes matter most? What happens — financially, operationally, and strategically — if each fails? How long can the organization tolerate each failure before consequences become unacceptable? BIA produces four formal outputs — criticality rankings, Recovery Time Objectives (RTO), Recovery Point Objectives (RPO), and Maximum Tolerable Downtime (MTD) — that serve as the authoritative inputs to Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP). BIA is not a risk assessment (which focuses on threat likelihood), not a BCP (which defines the recovery response), and not a DRP (which details technical restoration steps). BIA is the diagnostic foundation that makes all three meaningful.
Where it stops · what it isn't
- —BIA IS: a quantification of business disruption impact — financial, operational, and strategic — tied to specific recovery time and recovery point thresholds.
- —BIA IS NOT: a risk assessment or threat analysis. BIA assumes disruption will occur and asks 'what then?' — risk assessment asks 'how likely is this?'
- —BIA IS NOT: a Business Continuity Plan or Disaster Recovery Plan. BIA produces inputs (criticality rankings, RTO, RPO, MTD) that feed those plans; it does not prescribe recovery procedures.
- —BIA IS NOT: an IT availability report. System uptime percentages (e.g., 99.9%) describe technical performance; BIA translates downtime into business consequences (e.g., '$24.5M/day in lost revenue').
- —BIA scope excludes minor operational disruptions handled through normal incident management; it focuses on disruptions that threaten organizational survival or significant value loss.
- —BIA does not replace legal, regulatory, or contractual obligations — it informs and documents alignment with them.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESSystem and Operational Resilience (prerequisite: understanding how failures propagate through dependent systems)Enterprise Risk Management (ERM) framework (provides organizational risk appetite definition)
ENABLESBusiness Continuity Plan (BCP)Disaster Recovery Plan (DRP)Problem and Incident Management (severity classification uses BIA criticality rankings)
PART OFInformation Systems Operations and Business Resilience (ISACA CISA Domain 4)
RELATED TORisk Assessment (complementary: risk assessment evaluates threat likelihood; BIA evaluates impact magnitude)
CONSTRAINSIT Resource Allocation (BIA outputs justify and bound investment in recovery capabilities)