Incident Management · Topic 2 of 5
Business Impact Analysis, Continuity and Recovery Plans
The business impact analysis with RTO, RPO and maximum tolerable downtime, the continuity and disaster recovery plans, and how they link to incidents.
- 3 min
- Includes a diagram
- The BIA identifies critical processes and sets RTO and RPO with the business.
- RTO is time to restore; RPO is acceptable data loss; RTO fits within MTD.
- The BCP keeps the business running; the DRP restores IT.
What it is
The business impact analysis (BIA) identifies critical business processes and the impact of their disruption over time. The business continuity plan (BCP) keeps the business operating through a disruption. The disaster recovery plan (DRP) restores the IT systems and data those processes depend on. A serious security incident, such as ransomware, can trigger all three alongside the incident response plan.
How it works
The business impact analysis
The BIA, carried out with business process owners, identifies:
- Critical processes and their dependencies (systems, data, people, suppliers).
- The impact of an outage over time: financial, legal, customer, reputational.
- Recovery objectives:
| Objective | Meaning |
|---|---|
| Recovery time objective (RTO) | Maximum acceptable time to restore a process or system |
| Recovery point objective (RPO) | Maximum acceptable data loss, measured back in time from the disruption |
| Maximum tolerable downtime (MTD) | Longest outage before the business suffers unacceptable harm; the RTO must fit within it |
Senior management approves the BIA results. The BIA also feeds incident severity criteria: an incident affecting a process with a four-hour RTO is more severe than one affecting a process that can wait a week.
The business continuity plan
The BCP covers how critical processes continue: alternate work locations, manual workarounds, key staff and deputies, supplier arrangements, crisis management and communications. It is owned by the business, coordinated by a continuity function, and tested regularly.
The disaster recovery plan
The DRP covers technical recovery: priorities and sequence from the BIA, recovery sites (hot, warm, cold, cloud), backup and restore procedures, and the teams and steps involved. Recovery strategies must be able to meet the RTO and RPO; the security manager checks that recovery environments keep the required security controls.
How incident response, BCP and DRP relate
| Plan | Focus |
|---|---|
| IRP | Detect, contain and resolve the security incident |
| BCP | Keep the business running |
| DRP | Restore technology and data |
During ransomware, for example, the IRP contains the attack and preserves evidence, the DRP restores systems from clean backups, and the BCP keeps critical services going manually meanwhile. The plans must reference each other and agree on roles and decision points, such as who decides to invoke the DRP.
Recovering from backups during a security incident must use clean, verified backups. Restoring before the attacker's access is removed can reinfect the environment.
How the exam asks about this
- "What should be completed FIRST before developing recovery strategies?" The business impact analysis.
- "Which objective determines how often data is backed up?" The RPO.
- "Ransomware has encrypted servers. Which plans apply?" The IRP for containment, the DRP for restoration and the BCP for continuing operations.
What to remember for the exam
- The BIA identifies critical processes and sets RTO and RPO with the business.
- RTO is time to restore; RPO is acceptable data loss; RTO fits within MTD.
- The BCP keeps the business running; the DRP restores IT.
- IRP, BCP and DRP must be aligned and reference each other.
- Restore from clean backups only after the threat is removed.
A DRP that restores systems quickly but without their security controls, such as logging and access restrictions, creates a new exposure during recovery.
Common mistakes
Letting IT set recovery objectives alone. They are business decisions.
Keeping IRP, BCP and DRP in separate silos.
Restoring from backups that may contain the malware.
Check yourself
What does the recovery point objective define?
The maximum acceptable data loss, measured back in time from the disruption.
What must be true of the RTO in relation to the maximum tolerable downtime?
The RTO must be shorter than or equal to the MTD.
What is the main difference between the BCP and the DRP?
The BCP keeps business processes running; the DRP restores the IT systems and data they depend on.
Topic 2 of 5 in Incident Management
Test yourself on Incident Management
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.