Operations and Business Resilience · Topic 6 of 8
Business Impact Analysis and Business Continuity Planning
Business impact analysis, dependencies, RTO, RPO and maximum tolerable outage, and building, maintaining and auditing the business continuity plan.
- 4 min
- Includes a diagram
- BIA first: processes, dependencies, impact over time, recovery objectives.
- RTO = time to restore; RPO = acceptable data loss.
- MTO sets the outer limit; the RTO must be within it.
What it is
A business impact analysis (BIA) identifies the organization's critical business processes, what an interruption to each would cost over time, and how quickly each must be recovered. The business continuity plan (BCP) then sets out how the business keeps those processes running, or restores them, during and after a disruption.
How it works
The BIA
- Identify business processes and their owners.
- Map dependencies: systems, data, people, suppliers, facilities and other processes.
- Assess the impact of an outage over time: financial, legal and regulatory, customer, reputational, safety.
- Set recovery objectives with the business owners.
- Rank processes by criticality and get senior management approval.
Interviews and questionnaires with process owners are the main sources. Dependencies are where BIAs most often go wrong: a process rated low priority may feed one rated critical, so it is effectively critical too.
Recovery objectives
| Objective | Meaning | Drives |
|---|---|---|
| Recovery time objective (RTO) | Maximum acceptable time to restore a process or system after a disruption | Recovery strategy and site choice |
| Recovery point objective (RPO) | Maximum acceptable data loss, measured in time back from the disruption | Backup and replication frequency |
| Maximum tolerable outage (MTO), also called maximum tolerable downtime | Longest outage the business can survive | Upper limit for the RTO |
| Service delivery objective (SDO) | Level of service to reach during the recovery period | Capacity of recovery resources |
A low RTO or RPO means faster, more expensive recovery solutions. The business chooses the balance between cost and acceptable impact.
An RPO near zero needs real-time (synchronous) replication; nightly backups can lose up to a day of data, so they only meet an RPO of 24 hours or more. Match the backup method to the RPO, not the other way round.
The business continuity plan
A BCP typically includes:
- Scope, objectives and the authority to invoke the plan.
- Roles and responsibilities, with deputies, and up-to-date contact lists.
- Response procedures for the first hours: assessment, escalation, declaration.
- Continuity strategies for each critical process, including manual workarounds.
- Crisis communication to staff, customers, regulators and media.
- Links to the IT disaster recovery plans and incident response plan.
- Plan maintenance, training and testing schedules.
The BCP is owned by the business, approved by senior management and kept in a place reachable during a disaster, including away from the primary site.
Maintaining the plan
Plans go out of date as staff, systems and suppliers change. Reviews should follow major changes and happen at least annually. Lessons from tests and real events feed back into the plan.
What the auditor checks
- A current BIA, approved by management, underlies the plan.
- Recovery objectives are agreed by business owners, not set by IT alone.
- The plan covers all critical processes and their dependencies, including key suppliers.
- The plan is tested, results are documented and gaps are fixed.
- Copies are accessible off-site and contacts are current.
How the exam asks about this
- "What should be done FIRST when developing a BCP?" Perform a business impact analysis.
- "Which objective determines backup frequency?" The recovery point objective.
- "A low-priority process feeds a critical one." The BIA missed dependencies.
What to remember for the exam
- BIA first: processes, dependencies, impact over time, recovery objectives.
- RTO = time to restore; RPO = acceptable data loss.
- MTO sets the outer limit; the RTO must be within it.
- Business owners agree recovery objectives; senior management approves.
- Keep the BCP current, tested and available off-site.
A BCP stored only on the file server at the primary site is unavailable exactly when it is needed.
Common mistakes
Letting IT set the RTO and RPO. They are business decisions.
Confusing RTO and RPO. Time to recover versus data that can be lost.
Ignoring dependencies on other processes and suppliers.
Check yourself
What is the first step in business continuity planning?
A business impact analysis.
What does the recovery point objective measure?
The maximum acceptable amount of data loss, expressed as time before the disruption.
Who should agree the recovery objectives for a business process?
The business process owners, with senior management approval.
Topic 6 of 8 in Operations and Business Resilience
Test yourself on Operations and Business Resilience
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.