6.2.5. Business Impact Analysis

💡 First Principle: A Business Impact Analysis (BIA) identifies which business functions are critical and quantifies the impact of disrupting them. The BIA drives recovery priorities: the most critical functions get the shortest RTOs and the most resilient infrastructure. Without a BIA, organizations treat all systems equally — which means they either overspend on protecting non-critical systems or underspend on protecting critical ones.

BIA process: identify business functions, determine dependencies (people, technology, data, facilities), estimate impact of disruption over time (financial, operational, reputational, regulatory), and prioritize recovery. The key insight is that disruption impact isn't static — a system that's manageable offline for one hour may cause catastrophic losses if offline for 24 hours.

Impact categories:

• Financial — lost revenue, penalty costs, recovery expenses, overtime labor
• Operational — degraded service delivery, supply chain disruption, missed SLAs
• Reputational — customer trust erosion, brand damage, negative media coverage
• Regulatory — compliance violations, fines, mandatory disclosure, legal liability

BIA metrics that drive recovery planning:

• Maximum Tolerable Downtime (MTD) — the longest a function can be unavailable before causing irreversible damage
• Recovery Time Objective (RTO) — the target time to restore the function (must be less than MTD)
• Recovery Point Objective (RPO) — the maximum acceptable data loss measured in time (determines backup frequency)

BIA outputs feed directly into continuity planning: which functions need hot sites vs. cold sites, which data needs continuous replication vs. daily backups, and which systems require minutes-level RTO vs. days-level RTO. A payment processing system with $50,000/hour revenue impact gets different treatment than an internal wiki.

⚠️ Exam Trap: BIA determines what needs to be recovered and in what order. Disaster recovery planning determines how to recover it. BIA comes first — you can't design a recovery plan without knowing what's most important. MTD > RTO always — RTO must be shorter than MTD.