Business Impact Analysis

A Business Impact Analysis (BIA) is a structured process per ISO

22301 Clause 8.2.2 to identify critical business processes and assess potential impacts of disruptions. The BIA determines time parameters such as RTO (Recovery Time Objective), RPO (Recovery Point Objective) and MTPD (Maximum Tolerable Period of Disruption) as the foundation for BCM strategies. Per BSI Standard 200‑4, the BIA is the central building block of Business Continuity Management.

A BIA follows three core stages per BSI 200‑4: (1) Process identification — systematically catalogue all business processes and assign owners. (2) Impact analysis — assess potential consequences qualitatively and quantitatively (financial, reputational, regulatory, operational). (3) Time parameter determination — define MTPD, RTO, RPO and MBCO for each critical process. Structured BIA interviews with department heads and senior management complement the analysis. ISO/TS

22317 provides additional detailed BIA guidance.

The BIA (Business Impact Analysis) analyses the consequences of process disruptions — what happens when a process fails. Risk assessment evaluates likelihood and threat scenarios — why a process might fail. Under ISO 22301, both are required in Clause 8.2 and complement each other: the BIA delivers recovery priorities, while risk assessment identifies preventive measures. Together they form the analytical foundation for all BCM planning.

RTO (Recovery Time Objective) is the target time to restore a process after disruption. RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time. MTPD (Maximum Tolerable Period of Disruption) is the absolute upper limit for how long a process can be down before irreversible damage occurs. MBCO (Minimum Business Continuity Objective) describes the minimum acceptable performance level during a disruption. The BIA determines these parameters for every critical process.

Yes. Under the EU NIS-2 Directive (transposed in Germany as BSIG Section

30 Para.

2 No. 3), affected organisations must demonstrate measures for business continuity. The BIA is the central instrument for this, as it identifies critical processes and establishes recovery priorities. BSI Standard 200–4 provides the concrete implementation framework with three maturity stages: Reactive BCMS (4–8 weeks), Build-up BCMS (3–6 months) and Standard BCMS with full ISO

22301 conformity.

ISO

22301 Clause 8.2.2 defines BIA requirements but does not prescribe a specific template. ISO/TS

22317 provides detailed BIA guidance. BSI Standard 200–4 offers free templates including BIA presentation templates and interview questionnaires. A comprehensive BIA template should include: process profiles, impact categories (financial, regulatory, reputational), time parameter tables (RTO/RPO/MTPD), dependency matrices and prioritisation grids.

The BIA should be updated at least annually, with reviews recommended whenever significant changes occur to business processes, IT infrastructure or organisational structure. Per ISO

22301 Clause 9.1, regular monitoring and evaluation is mandatory. BSI Standard 200–4 also recommends event-driven updates after incidents, exercises or regulatory changes. An annual BIA review cycle is established best practice in BCM.