Business impact analysis: from process to a robust priority

Damage curves instead of gut feeling

For each relevant service, the analysis considers which financial, legal, operational or reputational consequences arise after defined outage periods. Consistent time steps and damage categories make results comparable.

The BIA should be developed together with the business units and supported by traceable assumptions. A plain spreadsheet survey without facilitation mostly produces false precision.

Dependencies become concrete requirements

From the prioritised service follow the resources it needs and their recovery requirements. These include people, applications, data, rooms, equipment and external services.

• Set the maximum tolerable period of disruption
• Determine the target recovery time for each service
• Describe the minimum acceptable level of service
• Assign critical resources and suppliers