Business Impact Analysis (BIA)

A business impact analysis helps a company identify which functions must be restored first when something goes wrong. It considers the consequences of interruption—not just the chance that an event will occur. A contractor may depend on dispatch phones, customer records, payment processing and access to job schedules; each system can have different tolerable outage periods and workarounds.

A practical BIA lists critical activities, their dependencies, the impact of delays, realistic disruption durations and recovery priorities. For example, losing online quote forms for an hour may be inconvenient, while losing dispatch access for two days could strand crews and damage contracts. Teams should gather information from the people who actually perform each function instead of guessing recovery priorities from website traffic alone.

NIST describes BIA as analysis of operational functions and the effect disruption could have on them. The assessment informs continuity and recovery plans, but it does not itself restore systems, eliminate risk or dictate one universal recovery deadline. It differs from a risk assessment, which considers hazards and likelihood, and from a post-mortem, which examines a failure after it occurs.