Glossary
Business impact analysis (BIA)
A business impact analysis is a structured assessment of how an outage harms the organization and how that harm grows with time. Its output is a ranking of business activities and the recovery time and data-loss limits each one can tolerate.
Why does every system end up tier one?
Ask each application owner whether the system is critical and the answer is almost always yes. Without a structured process, recovery targets are set by whoever asks the loudest, or by IT alone using its own sense of importance. The result is a flat list in which everything is top priority and protection spending is spread evenly, so the systems where damage accelerates fastest get no more than a reporting database. A business impact analysis replaces opinion with measurement.
How is a BIA carried out?
The people who run each business process, not the infrastructure team, score what an outage costs at fixed points such as one hour, one day and one week. The scores cover several kinds of harm: lost revenue, customers affected, legal or regulatory exposure, reputation and safety. The point where the worst score becomes unacceptable defines the maximum tolerable downtime for that activity.
Two targets follow from that curve. The recovery time objective is set shorter than the maximum tolerable downtime, with room left for the steps that come after systems are back. The recovery point objective is set by how much recent work the process can afford to redo or lose, which depends on how it is fed and who can re-enter missing data.
From curves to recovery tiers
A useful analysis ends in three or four tiers, not in a target per application. Systems whose damage grows within minutes sit at the top and justify standby capacity. Systems that can wait a day go in a middle tier restored from backup. Low-priority systems can wait days or weeks. Dependencies adjust the ranking: a modest application that a critical one cannot start without inherits the higher tier.
| Tier | Typical damage pattern | Protection it justifies |
|---|---|---|
| Top | Losses start within minutes | Replication to a standby site, tested failover |
| Middle | Painful after a day, tolerable for hours | Frequent backups, restore into pre-arranged capacity |
| Lower | Little harm for several days | Periodic backup, rebuild when time allows |
What a BIA drives downstream
The tiers feed the disaster recovery plan, the choice among hot, warm and cold sites, and backup retention and frequency. For storage, tiers map to different protection levels, such as one erasure coding layout or retention setting for critical data and a cheaper one for the rest. A BIA that is never revisited goes stale as systems, suppliers and regulations change.
Frequently asked questions
Who owns the business impact analysis?
Business process owners provide the impact scores, and a continuity or risk function usually coordinates. IT supplies dependency and cost information but does not set the tolerance.
What is the difference between a BIA and a risk assessment?
A risk assessment estimates how likely threats are. A BIA assumes the disruption has happened and measures its consequences, whatever the cause.
How often is a BIA refreshed?
Many organizations review it annually and after major changes such as a new application, an acquisition or a move to the cloud.
Related terms
- Business continuity: the program a BIA opens.
- Recovery point objective: the data-loss limit derived from the analysis.
- Disaster recovery plan: the restore sequence built on the tiers.
- Storage tiering: matching data to storage by importance and cost.
- Hot site: the standby the top tier can justify.
- Retention policy design: how long copies are kept per tier.