← All Blogs

What a business impact analysis actually produces

By Best IT MSP Editorial Team - Updated October 22, 2026 - 11 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What does a business impact analysis actually produce?

A business impact analysis produces a ranked list of your business functions, the operational and financial cost of losing each one, the resources and dependencies each one needs, and the order they get recovered in. It is a report with a table in it. One row per function, a cost attached to an hour, a day and a week without it, the systems and people that function depends on, and a rank. If what you were handed has no table and no rank, it is not this document.

FEMA describes it as a document that predicts the consequences of a disruption to your business, and is specific about the output. The BIA report should prioritize the order of events for restoring business functions, and business processes with the greatest operational and financial impacts should be restored first. NIST's glossary defines the exercise as the process of analyzing operational functions and the effect that a disruption might have on them.

FEMA names seven impacts to price, which matters because most owners price only the first one. They are lost sales and income, delayed sales or income, increased expenses, regulatory fines, contractual penalties or loss of contractual bonuses, customer dissatisfaction or defection, and delay of new business plans. Timing counts as much as duration. The point in time when a business function or process is disrupted can have a significant bearing on the loss sustained, so a payroll bureau loses more on the 28th than on the 12th.

If the vocabulary is still blurry, Business Continuity vs Disaster Recovery separates the two plans. This post is the analysis underneath both.

Your recovery targets are outputs, not inputs

Recovery targets come out of the analysis rather than into it. FEMA states the order plainly. Priorities and recovery time objectives for information technology should be developed during the business impact analysis, and the business impact analysis should evaluate the potential for lost data and define the recovery point objective.

Read that twice, because it inverts how most proposals are written. A provider who quotes a four-hour recovery time objective and a 24-hour recovery point objective before anyone ranked your functions has not measured your tolerance for loss. They published their own default and put your name on it.

FEMA closes the loop the other way too. The recovery time for an IT resource should match the recovery time objective for the business function or process that depends on it. The chain runs one way. Function, then impact, then target, then technology, then price.

We treat the two targets as price dials in RTO and RPO: the two numbers that decide what you pay. This post is about the document that is supposed to set them.

What the analysis is supposed to enumerate

Four things get enumerated. Functions, resources, dependencies, and the order of recovery. Miss one and the document cannot support a decision.

• Functions. Every activity that earns money, pays people or keeps you legal. Taking orders, invoicing, running payroll, dispatching engineers.
• Resources. CISA's asset inventory goal sets the width of this column, naming six asset types as the scope, data, hardware, software, systems, facilities and personnel.
• Dependencies. FEMA tells you to identify critical software applications and data and the hardware required to run them. A cheap system that three critical business functions depend on outranks an expensive one nobody uses.
• Order. The BIA report should prioritize the order of events for restoring business functions. Without a documented sequence, everything is tier one at 2am and the engineer picks for you.

Two controls you already pay for depend on that ranking, and this is the part almost nobody points out. CISA tells you to keep an asset inventory and adds that IT and OT assets determined to be critical for business or operational functions should be updated on a more frequent basis. Its backup goal asks you to frequently back up all systems necessary for operations on a regular schedule consistent with the needs of the organization.

Determined by whom? Consistent with which needs? Neither sentence works until somebody ranked your functions. The business impact analysis is the missing input to controls already on your invoice, so skipping it saves you nothing. It moves the decision to your provider.

The template is free, from two federal agencies

Two federal agencies publish a business impact analysis template and neither charges a cent. FEMA offers a BIA questionnaire worksheet on the page itself. NIST publishes a business impact analysis template as a Word file, next to three contingency plan templates for low, moderate and high impact systems, as supplemental material to its contingency planning guide, SP 800-34 Rev. 1.

That changes what you are buying. The form costs nothing, so a provider's fee buys facilitation, the interviews, the dependency mapping and the measured restore times. Those are real work and worth paying for. A five-figure license for a proprietary BIA framework is a charge for a download.

NIST frames the guide the same way. Its stated purpose is to help people evaluate information systems and operations to determine contingency planning requirements and priorities. Requirements and priorities are determined by the exercise, not brought to it.

What makes a business impact analysis worthless

An analysis is worthless when your provider supplied the impact numbers. FEMA's method is a survey of your people, not a desk exercise. Use a BIA questionnaire to survey managers and others within the business, and survey those with detailed knowledge of how the business manufactures its products or provides its services.

Nobody at your provider knows what a Thursday without dispatch costs you. They can measure how long a restore takes and map what depends on what. They cannot price an hour of your lost billing, and the honest ones say so.

Three more failure modes show up in documents that look finished.

• No cost comparison. FEMA says these costs should be compared with the costs for possible recovery strategies. Impact figures with no prices beside them cannot change a purchase.
• No measured restore times. FEMA says data restoration times should be confirmed and compared with the IT and business function recovery time objectives. A target nobody has timed is a wish, and How Long a Full Restore Takes, Measured Not Guessed covers the evidence to ask for.
• No named respondents. A questionnaire with no names and no date was filled in by one person in a hurry.

Regulation predicts this failure rather than preventing it. The HIPAA Security Rule contingency plan standard makes the data backup plan, the disaster recovery plan and the emergency mode operation plan required, while applications and data criticality analysis is listed as addressable, a duty to assess the relative criticality of specific applications and data in support of other contingency plan components. An addressable specification still has to be dealt with, but it carries the softer label, and softer labels get skipped. That is the gap we see in real businesses. A business continuity plan sits on a shelf with nothing in it that says which function comes back first.

A document that ranks nothing changed nothing. That is not an analysis, it is a template somebody filled in.

Rank your functions against the bad week, not the average one

Rank functions against the worst week you could plausibly have, because the average week never tests the plan. A two-hour power cut and a three-week extortion event rank your functions differently, and only the second one closes businesses.

The tail is documented. IBM puts the global average cost of a data breach at $4.99 million and reports an average of 247 days to identify and contain an active breach across all industries. Verizon found ransomware in 48 percent of all breaches, up from 44 percent. Sophos surveyed 2,158 organizations of 100 to 5,000 employees across 17 countries and put the average cost to recover from a ransomware attack at $1.7 million. Those are other people's numbers, scoped to other people's businesses. The analysis exists to replace them with yours.

A finished ranking then moves specific things, and that is how you test whether it was real.

• The backup schedule. A function with a one-hour recovery point objective cannot sit on a nightly job, so the ranking either changes the schedule or admits the target is fiction.
• The test order. You time a restore of the tier-one systems first, because that is where a wrong assumption costs the most.
• The out-of-hours expectation. A function that has to be back in minutes needs a named escalation path rather than a voicemail box.
• The insurance conversation. The financial column is what sizes business interruption insurance, which is separate from the policy covering your hardware. What to Do When Your Office Floods, Hour by Hour works one hazard through in detail.

The smallest honest version for a 20-person business

To run the smallest honest version, book two hours, put four people in a room and fill one page per function. A 20-person business does not need a consulting engagement. It needs the free worksheet and the people who know where the money comes from.

Four people belong in the room.

• The owner, who decides what counts as an unacceptable loss.
• Whoever bills, because the revenue, deadline and penalty numbers live in the ledger.
• Whoever runs the work, the person who takes orders or schedules jobs.
• Your provider, present as a witness rather than an author. They supply measured restore times and the dependency map, and leave the impact column blank.

Five outputs come out of that afternoon.

• Rank every function into four tiers, from minutes through to one week.
• Quantify one hour, one day and one week without each tier-one function.
• List the systems, data, people and facilities each function needs.
• Set a recovery time objective and recovery point objective per tier, then get them into the service level agreement.
• Document who answered, on what date, and what the last restore test measured.

Price the idle hour with a figure you can look up. The Bureau of Labor Statistics puts total employer compensation costs for private industry workers at $46.89 per hour worked. Multiply that by the people who cannot work, add the gross profit on the sales you cannot take, and you have a defensible downtime cost.

Five questions to ask about the analysis you were handed

Five questions separate a real analysis from a filled-in template. Send them in one email and keep the reply.

• Which functions were ranked, and in what order? A good answer is a short table. A weak one is a paragraph about resilience.
• Who answered the impact questions, and on what date? You want names from your own payroll and a recent date.
• What did the ranking change? A target moved, a backup schedule changed, a system got demoted. If nothing changed, nothing was analyzed.
• Which restore times were measured rather than assumed? FEMA asks for restoration times to be confirmed against the objectives, so ask which systems were timed.
• Where is the cost comparison? Impact figures beside the price of each recovery option, which is the comparison FEMA's page asks for.

Testing the plan produces a different artifact. Ask for the after action report instead, as we set out in Untested Incident Response Plan? Ask for the After Action Report, and the wider paperwork list sits in 8 Documents Your MSP Should Be Able to Hand You on Request.

None of this makes an outage impossible, and no honest provider promises that. What it buys is a ranked, documented and measurable view of which parts of your business fail first and what each one is worth. Best IT MSP is an independent directory. We rank providers on verified rating and firmographic data, we label paid placement, and we do not sell IT services or continuity software. The provider who asks what your Thursday is worth is doing the analysis. The one who hands you a four-hour target in week one is doing a template.

FAQ

What is a business impact analysis?

A business impact analysis works out what losing each business function costs and in what order functions come back. NIST defines it as the process of analyzing operational functions and the effect that a disruption might have on them. FEMA says it predicts the consequences of a disruption to your business.

What does a business impact analysis produce?

It produces a report with a ranked table of business functions, the cost of losing each one, the resources and dependencies each needs, and a recovery sequence. FEMA says the BIA report should prioritize the order of events for restoring business functions, with the greatest impacts restored first.

Does a business impact analysis set the RTO and RPO?

Yes. FEMA says priorities and recovery time objectives for information technology should be developed during the business impact analysis, and that the analysis should evaluate the potential for lost data and define the recovery point objective. Targets quoted before any analysis are the provider's defaults.

Is there a free business impact analysis template?

Yes, from two federal agencies. FEMA publishes a BIA questionnaire worksheet on its business impact analysis page, and NIST publishes a business impact analysis template as a Word file beside SP 800-34 Rev. 1. Pay a provider for facilitation and measurement, not for the form.

Should my MSP do the business impact analysis or should I?

Both, in different columns. FEMA's method is to survey those with detailed knowledge of how the business manufactures its products or provides its services, which is your staff. Your provider supplies the dependency map and measured restore times. Nobody there can price an hour of your lost billing.

← All Blogs