← Standards
ISO/TS 22317:2021ISO

Guidelines for business impact analysis (BIA)

The only normative text devoted entirely to the BIA. It sets out the three levels of analysis (strategic, tactical, operational), how to establish maximum tolerable periods of disruption, and how to avoid the bias where every function declares itself critical.

Official text

Who it applies to

  • Anyone facilitating a BIA
  • Business process owners
  • Operational risk analysts

Structuring points

  • A BIA produces durations, not opinions: MTPD, RTO, RPO and MBCO
  • Executive validation turns a data-collection exercise into a decision
  • Three levels of analysis keep the exercise from drowning in detail
  • Interdependencies often matter more than the activities themselves

Conducting, validating and maintaining a BIA across an organisation.

Requirements 2