{
  "slug": "business-impact-analysis",
  "term": "Business impact analysis",
  "aliases": [
    "BIA"
  ],
  "definition": "A business impact analysis evaluates disruption consequences and dependencies to inform recovery requirements and priorities.",
  "note": "Method: Identify supported processes and the effects of their interruption, the resources they need, and recovery priorities. Process owners help determine acceptable downtime and data loss. [nist-recovery]\n\nStorage decisions: These requirements inform backup frequency, recovery architecture and retained recovery points. Dependants must have compatible objectives, and impact can rise sharply after a deadline rather than increasing at a constant rate. [recovery-planning]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    {
      "text": "Recovery objectives still need to be tested against the implemented recovery strategy.",
      "citationIds": [
        "recovery-planning"
      ]
    }
  ],
  "related": [
    "maximum-tolerable-downtime",
    "recovery-time-objective",
    "recovery-point-objective",
    "backup",
    "restore-test"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-19",
  "citations": [
    {
      "id": "nist-recovery",
      "title": "NIST SP 800-34 Rev. 1 (2010), sections 3.2 and 3.5: impact, recovery objectives and testing",
      "url": "https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-34r1.pdf",
      "accessed": "2026-10-19"
    },
    {
      "id": "recovery-planning",
      "title": "AWS Well-Architected Framework (2024-06-27), REL13-BP01: recovery objectives and dependencies",
      "url": "https://docs.aws.amazon.com/wellarchitected/2024-06-27/framework/rel_planning_for_recovery_objective_defined_recovery.html",
      "accessed": "2026-10-19"
    },
    {
      "id": "hesela-recovery",
      "title": "Hesela: Snapshots and backups: which failures can you recover from?",
      "url": "https://hesela.com/analyses/snapshot-backup-recovery-boundaries/",
      "accessed": "2026-10-19"
    }
  ],
  "provenance": [
    "The three-step structure follows NIST SP 800-34 Rev. 1, section 3.2. The cloud architecture source adds workload dependencies and nonlinear impact considerations. [nist-recovery] [recovery-planning]"
  ]
}