Business Impact Analysis Template (ISO 22301, MTPD, RTO, RPO)

Business Impact Analysis: [Organization or scope name]

A stand-alone business impact analysis (BIA) that identifies the organization's prioritized activities, assesses how the impact of a disruption grows over time, and sets the maximum tolerable period of disruption (MTPD), recovery time objective (RTO), recovery point objective (RPO) and minimum business continuity objective (MBCO) for each activity, together with the people, information, ICT, facilities and suppliers each one needs. Structure aligned with ISO 22301:2019 with Amd 1:2024 (clause 8.2.2) and ISO/TS 22317:2021, with NIST SP 800-34 Rev. 1 as a free alternative method. The results feed the business continuity plan, the disaster recovery plan and the risk assessment. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and method
2. Impact categories and criteria
3. Products, services and activities
4. Impact over time
5. Time objectives
6. Prioritized activities
7. Dependencies and resources
8. Gap analysis
9. Outputs and traceability
10. Review and maintenance
11. Glossary and references

1. Purpose, scope and method

1.1 Purpose

This BIA determines which activities of [Organization] must be resumed first after a disruption, how quickly, at what minimum level, and with which resources. Its results are the basis for the continuity strategies and solutions in [BCP reference] and the recovery design in [DR plan reference].

1.2 Scope

1.3 Method

The method follows the steps that ISO 22301:2019 clause 8.2.2 sets for a BIA, written here in original wording:

1. Define the impact types and the criteria that describe each level of impact (section 2).
2. Identify the activities that support the delivery of products and services (section 3).
3. Assess the impacts of not performing each activity over time (section 4).
4. Find the point at which the impact of not resuming an activity becomes unacceptable, and set the prioritized timeframe for resuming it at a specified minimum capacity (section 5).
5. Use the results to identify prioritized activities (section 6).
6. Determine the resources needed to support prioritized activities, and the dependencies, including partners and suppliers, and interdependencies between activities (section 7).

ISO/TS 22317:2021 gives guidance on running the BIA as a programme, scoping it, and analysing at the level of products and services, processes, activities and resources. NIST SP 800-34 Rev. 1 (section 3.2) gives a free alternative for information systems in three steps: determine mission and business processes and recovery criticality, identify resource requirements, and identify recovery priorities for system resources.

1.4 Data collection

2. Impact categories and criteria

Score each impact category from 1 to 5. The overall impact at a point in time is the highest score in any category, not the average, so that one severe consequence is never diluted by mild ones.

Define the unacceptable level: an activity reaches its MTPD at the earliest time point where its overall impact score is 4 or higher. Record the threshold the sponsor approved: [threshold and approval reference].

ISO 22301:2019 Amd 1:2024 added a requirement to determine whether climate change is a relevant issue when the organization determines its context. Where climate related events (heat, flood, storms) could affect sites or suppliers, note them in the risk assessment and check whether they change peak periods or dependencies recorded here.

3. Products, services and activities

3.1 Products and services

3.2 Activities

4. Impact over time

4.1 Time points

Use the same time points for every activity: 4 hours, 24 hours, 72 hours, 1 week (168 hours) and 2 weeks (336 hours). Add shorter points (for example 1 hour) for activities with real-time obligations.

4.2 Detailed assessment (one table per activity)

Example: ACT-01 Customs declaration filing, assessed for the peak season.

Rationale recorded at interview: goods held at the border start to accrue storage and demurrage charges after the first day; declarations not lodged within the statutory window expose customers and the broker to penalties, which drives the legal score to 4 at 24 hours.

4.3 Summary of overall scores

5. Time objectives

5.1 Definitions used in this BIA

NIST SP 800-34 Rev. 1 uses maximum tolerable downtime (MTD), which plays the role of MTPD for an information system, and splits it into RTO plus work recovery time (WRT): the time to verify data and bring the process back after the system is restored. Plan so that RTO plus WRT stays within the MTPD.

5.2 Rules

1. RTO is no more than 50% of MTPD, leaving the remainder for detection, decision, invocation and work recovery. [Adjust the percentage and record the approval.]
2. The RTO of every application and supplier an activity depends on is no longer than the activity's RTO.
3. The RPO is no longer than the period of transactions the activity can re-enter or reconstruct from other sources within its RTO.
4. MBCO is stated as a measurable volume, not as "reduced service".

5.3 Objectives

6. Prioritized activities

ACT-03 ranks above ACT-02 with the same RTO because its RPO is shorter and its peak-season impact at 72 hours is driven by contractual credits that start sooner.

Activities not listed as prioritized are resumed after the tiers above, in the order set by [BC manager] at the time, unless their MTPD changes at the next review.

7. Dependencies and resources

7.1 People

7.2 Information and ICT

7.3 Facilities and equipment

7.4 Suppliers and partners

7.5 Interdependencies between activities

Arrows point from the provider of an input to the activity that needs it. A disruption of the TMS therefore affects ACT-02 and ACT-04 directly and ACT-03 through the booking feed.

8. Gap analysis

Record each gap in the risk register (compliance/risk-register) so that its treatment is tracked with other risks, and reference the risk ID here once assigned.

9. Outputs and traceability

Traceability matrix:

10. Review and maintenance

Review the BIA at least [annually] and also when any of these triggers occurs:

• a new product, service, site, legal entity or major customer contract;
• a change of a critical supplier or of a core application;
• a merger, acquisition, restructuring or outsourcing decision;
• an exercise or real disruption showing that an objective was wrong;
• a change in legal or regulatory deadlines that affect impact scores.

Report the BIA status, open gaps and any changed objectives to the management review (compliance/management-review).

11. Glossary and references

11.1 Glossary

11.2 References

Standard and licence note

Structure aligned with ISO 22301:2019 with Amd 1:2024 (clause 8.2.2) and ISO/TS 22317:2021, cited by name, edition and clause number only, and based on NIST SP 800-34 Rev. 1, a US government publication. This template is original text written for this collection and reproduces no wording, tables or definitions from the ISO documents. Check the current editions before use, including the status of the ISO 22301 revision.

Official text: ISO, purchase or licensed access: https://www.iso.org/standard/75106.html (ISO 22301:2019), https://www.iso.org/standard/88412.html (Amd 1:2024) and https://www.iso.org/standard/79000.html (ISO/TS 22317:2021), also available from national standards bodies. NIST SP 800-34 Rev. 1 is free at https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final.

Template licence: MIT.