A business impact analysis (BIA) is a structured assessment that shows how an interruption to each business function would hurt revenue, operations, and compliance over time. The result is a ranked list of what to restore first and how fast.<\/p>\n\n\n\n
Downtime is costly. An ITIC survey<\/a> found that over 90% of mid-size and large enterprises say one hour of downtime costs more than $300,000.<\/p>\n\n\n\n Whether you run continuity planning for a hospital, a retailer, or a small firm, the method is the same. Here, we’ll break down the key terms, a six-step process, a worked example, and the survey questions that make a BIA usable.<\/p>\n\n\n\n\n\n A business impact analysis is a process that identifies an organization’s critical functions and measures how much damage losing each one would cause as time passes. It answers three practical questions:<\/p>\n\n\n\n A BIA is the foundation of business continuity planning (BCP), the documented set of actions that keeps a company operating through a disruption. It also feeds the disaster recovery (DR) plan, which restores technology after an outage. Both plans are only as good as the priorities the BIA sets.<\/p>\n\n\n\n Three public references shape how most teams run one. The National Institute of Standards and Technology (NIST) describes a three-step BIA in NIST SP 800-34<\/a>. The International Organization for Standardization (ISO) publishes ISO\/TS 22317<\/a>, guidelines for designing a BIA process (the 2021 edition replaced the 2015 version). In the US, Ready.gov<\/a> offers a BIA worksheet for organizations of any size.<\/p>\n\n\n\n A BIA matters because it replaces guesses about downtime with numbers the business has agreed on. Without one, recovery order often follows whoever pushes hardest during an outage. The same ITIC survey reports that 41% of enterprises put one hour of downtime between $1 million and $5 million or more.<\/p>\n\n\n\n A completed BIA gives you:<\/p>\n\n\n\n A BIA measures the impact of losing a function, whatever the cause. A risk assessment estimates the likelihood of the threats that could cause the loss. Most teams run the BIA first, so risk work focuses on threats to the processes that matter. For the second half of that pairing, see QuestionPro’s guide to risk analysis<\/a>.<\/p>\n\n\n\n\nWhat is a business impact analysis?<\/strong><\/h2>\n\n\n\n
\n
Why does a business impact analysis matter?<\/strong><\/h2>\n\n\n\n
\n
How is a business impact analysis different from a risk assessment?<\/strong><\/h2>\n\n\n\n