What is a Business Impact Assessment (BIA)?

A BIA identifies activities that support delivery of products and services, assesses the impact over time of not performing them, and sets prioritized timeframes (MTPD, RTO) for resumption. ISO 22301 Clause 8.2.2 requires it as the evidence base for continuity planning.

How does a BIA relate to a BCP and DRP?

The BIA produces the RTO, RPO, MTPD, and dependency data that drive the Business Continuity Plan (BCP), which describes how the organization keeps delivering products and services during disruption. The Disaster Recovery Plan (DRP) is the technology arm of the BCP and inherits the same recovery targets from the BIA.

What is the difference between RTO and RPO?

RTO (Recovery Time Objective) is the maximum tolerable time to restore an activity after disruption. RPO (Recovery Point Objective) is the maximum tolerable data loss, measured backwards from the disruption. Both are outputs of the BIA and inputs to the DRP.

Maximum Tolerable Period of Disruption — the upper bound on downtime before impact becomes unacceptable to the business. The RTO must be shorter than the MTPD.

Why a Business Impact Assessment matters

Referenced against ISO 22301 — the international standard for Business Continuity Management Systems (BCMS).

What ISO 22301 says

ISO 22301 (Clause 8.2.2) requires organizations to perform a Business Impact Analysis to determine priorities and requirements for continuity. Specifically, the standard requires you to:

Identify activities that support the delivery of products and services.
Assess the impacts over time of not performing these activities.
Set prioritized timeframes for resuming activities at a specified minimum acceptable capacity (the MTPD and RTO).
Identify dependencies and supporting resources for these activities, including suppliers and outsource partners.

BIA → BCP → DRP

The BIA is the evidence base that justifies every downstream continuity investment:

Business Continuity Plan (BCP) — driven by BIA outputs (RTO, MBCO, dependencies) to describe how the organization continues delivering products and services during disruption.
Disaster Recovery Plan (DRP) — the technology arm of the BCP; the BIA’s RPO defines the acceptable data-loss window that DR architecture (backups, replication, failover) must meet.

Without a BIA you cannot defensibly set an RTO or RPO. Without RTO/RPO your BCP and DRP become opinions rather than engineered controls.

How Contanam BIA aligns

Per-line-of-business questionnaires seeded with ISO 22301-aligned prompts.
Explicit RTO / RPO / MTPD capture that feeds into your BCP and DRP.
Risk register with likelihood × impact scoring and cost estimation.
Evidence library reusable across BIAs, so audit trails compound.
Framework mapping — ISO 27001, GDPR, CMMC, HIPAA, NIST 800-53 — at the company level.