# Business Impact Analysis
**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0
*Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution.
| System name | System identifier | Prepared by | Date |
| --- | --- | --- | --- |
| [Fill in: system name] | [Fill in: unique system identifier] | [Fill in: names and titles] | [Fill in: date] |
## 1. Overview
This analysis identifies the mission and business processes [Fill in: system name] supports, the impact of a disruption to them, and the system's recovery objectives and priorities (CP-2a.1, CP-2a.2).
## 2. System description
[Fill in: a short description of the system, its purpose, where it runs and its main components, or a reference to the system security plan]
## 3. Determine process and system criticality
### 3.1 Mission and business processes
| Mission or business process | Description | Process owner |
| --- | --- | --- |
| [Fill in: process] | [Fill in: description] | [Fill in: owner] |
### 3.2 Outage impacts
Rate the impact of an outage on each process in each category the organization uses, for example with the impact levels of the security categorization.
| Process | [Fill in: impact category, for example operations] | [Fill in: impact category, for example finances] | [Fill in: impact category, for example individuals] | [Fill in: impact category, for example legal or regulatory] | Overall impact |
| --- | --- | --- | --- | --- | --- |
| [Fill in: process] | [Fill in: impact] | [Fill in: impact] | [Fill in: impact] | [Fill in: impact] | [Fill in: impact] |
### 3.3 Estimated downtime
- **Maximum tolerable downtime (MTD):** "the total amount of time leaders/managers are willing to accept for a mission/business process outage or disruption and includes all impact considerations" (SP 800-34 Rev. 1).
- **Recovery time objective (RTO):** "the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes, and the MTD."
- **Recovery point objective (RPO):** "the point in time, prior to a disruption or system outage, to which mission/business process data must be recovered (given the most recent backup copy of the data) after an outage."
| Process | Essential? | MTD | RTO | RPO |
| --- | --- | --- | --- | --- |
| [Fill in: process] | [Fill in: yes or no] | [Fill in: time] | [Fill in: time] | [Fill in: time] |
The RTO must be shorter than the MTD, leaving time to validate the recovered system. Backups must be frequent enough to meet the RPO (CP-9).
## 4. Identify resource requirements
List the resources the system needs to run its processes: hardware, software, cloud services, data, facilities, connections and people. Mark the critical assets that support [Select one: all; essential. Typical: essential] mission and business functions (CP-2(8)).
| System resource or component | Platform, operating system and version | Description | Critical asset? |
| --- | --- | --- | --- |
| [Fill in: resource or component] | [Fill in: platform] | [Fill in: description] | [Fill in: yes or no] |
## 5. Identify recovery priorities for system resources
Recovery priorities follow from the processes' outage impacts and RTOs. The plan resumes [Select one: all; essential. Typical: essential] mission and business functions first (CP-2(3)).
| Priority | System resource or component | Recovery time objective |
| --- | --- | --- |
| 1 | [Fill in: resource] | [Fill in: time] |
| 2 | [Fill in: resource] | [Fill in: time] |
## 6. Approval
| Name | Title | Signature | Date |
| --- | --- | --- | --- |
| [Fill in: name] | [Fill in: business or process owner] | | [Fill in: date] |
| [Fill in: name] | [System owner] | | [Fill in: date] |
Review this analysis with the contingency plan, and whenever the processes the system supports, or their priorities, change.