Business Impact Analysis
Business Impact Analysis template: The analysis of what a system's disruption would do to the mission and business processes it supports, setting the recovery objectives and priorities the contingency plan uses, following the NIST SP 800-34 Rev. 1 BIA template.
| Type | Program stage | Status | Template version | NIST basis |
|---|---|---|---|---|
| Report | Core | Draft | 1.0.0 | SP 800-53 release 5.2.0 |
What it is
Section titled “What it is”The analysis of what a system’s disruption would do to the mission and business processes it supports, setting the recovery objectives and priorities the contingency plan uses, following the NIST SP 800-34 Rev. 1 BIA template.
Controls satisfied
Section titled “Controls satisfied”| Control | Title |
|---|---|
| CP-2 | Contingency Plan |
| CP-2(3) | Resume Mission and Business Functions |
| CP-2(8) | Identify Critical Assets |
Downloads
Section titled “Downloads”| Variant | Ready to adopt | Annotated |
|---|---|---|
| All baselines | Word · Markdown | Word · Markdown |
Preview (annotated)
Section titled “Preview (annotated)”| System name | System identifier | Prepared by | Date |
|---|---|---|---|
| Fill in: system name | Fill in: unique system identifier | Fill in: names and titles | Fill in: date |
1. Overview
Section titled “1. Overview”This analysis identifies the mission and business processes Fill in: system name supports, the impact of a disruption to them, and the system’s recovery objectives and priorities (CP-2a.1, CP-2a.2).
2. System description
Section titled “2. System description”Fill in: a short description of the system, its purpose, where it runs and its main components, or a reference to the system security plan
3. Determine process and system criticality
Section titled “3. Determine process and system criticality”3.1 Mission and business processes
Section titled “3.1 Mission and business processes”| Mission or business process | Description | Process owner |
|---|---|---|
| Fill in: process | Fill in: description | Fill in: owner |
3.2 Outage impacts
Section titled “3.2 Outage impacts”Rate the impact of an outage on each process in each category the organization uses, for example with the impact levels of the security categorization.
| Process | Fill in: impact category, for example operations | Fill in: impact category, for example finances | Fill in: impact category, for example individuals | Fill in: impact category, for example legal or regulatory | Overall impact |
|---|---|---|---|---|---|
| Fill in: process | Fill in: impact | Fill in: impact | Fill in: impact | Fill in: impact | Fill in: impact |
3.3 Estimated downtime
Section titled “3.3 Estimated downtime”- Maximum tolerable downtime (MTD): “the total amount of time leaders/managers are willing to accept for a mission/business process outage or disruption and includes all impact considerations” (SP 800-34 Rev. 1).
- Recovery time objective (RTO): “the maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported mission/business processes, and the MTD.”
- Recovery point objective (RPO): “the point in time, prior to a disruption or system outage, to which mission/business process data must be recovered (given the most recent backup copy of the data) after an outage.”
| Process | Essential? | MTD | RTO | RPO |
|---|---|---|---|---|
| Fill in: process | Fill in: yes or no | Fill in: time | Fill in: time | Fill in: time |
The RTO must be shorter than the MTD, leaving time to validate the recovered system. Backups must be frequent enough to meet the RPO (CP-9).
4. Identify resource requirements
Section titled “4. Identify resource requirements”List the resources the system needs to run its processes: hardware, software, cloud services, data, facilities, connections and people. Mark the critical assets that support Select one: all; essential Typical: essential mission and business functions (CP-2(8)).
| System resource or component | Platform, operating system and version | Description | Critical asset? |
|---|---|---|---|
| Fill in: resource or component | Fill in: platform | Fill in: description | Fill in: yes or no |
5. Identify recovery priorities for system resources
Section titled “5. Identify recovery priorities for system resources”Recovery priorities follow from the processes’ outage impacts and RTOs. The plan resumes Select one: all; essential Typical: essential mission and business functions first (CP-2(3)).
| Priority | System resource or component | Recovery time objective |
|---|---|---|
| 1 | Fill in: resource | Fill in: time |
| 2 | Fill in: resource | Fill in: time |
6. Approval
Section titled “6. Approval”| Name | Title | Signature | Date |
|---|---|---|---|
| Fill in: name | Fill in: business or process owner | Fill in: date | |
| Fill in: name | System owner | Fill in: date |
Review this analysis with the contingency plan, and whenever the processes the system supports, or their priorities, change.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.