Audit
BIA Readiness Assessment: know which processes must be back up first
Without a business impact analysis, every contingency plan remains guesswork. We put the groundwork in place with you and carry out the first BIA together with your process owners, in line with ISO 22301 and suitable for DORA and NIS‑2.
Free and without obligation. You will receive your proposal within 48 hours.
What the BIA Readiness Assessment covers
We prepare your BIA in line with ISO 22301 and ISO/TS 22317 and carry it out with you:
- Readiness check: the process map, contingency plans and risk analyses you already have
- Scope: the sites, products and services you want to protect
- Impact criteria: impact categories and scales for financial, legal and reputational consequences
- Method and templates: questionnaire, time intervals and roles, tailored to your organisation
- First BIA: workshops with your process owners
- Dependencies: staff, IT systems, buildings and suppliers
Your result: a robust BIA with clear recovery objectives
You know which processes must be back up and how quickly:
- Your time-critical business processes, prioritised for recovery
- Maximum tolerable period of disruption, recovery time objective (RTO) and recovery point objective (RPO) for each process
- Resources and dependencies that define the requirements for IT recovery
- A documented BIA method and an action plan for your ISO 22301 BCM
How your business impact analysis works
First we lay the groundwork, then we analyse together with your team:
- Initial conversation: reason, scope, existing documents.
- Your proposal with scope and approach
- Readiness assessment: method, impact criteria and templates.
- First BIA: workshops with the process owners and evaluation.
- Results meeting with management and action plan, continuing with our ISO 22301 consulting if you wish.
Why Securitects
- BCM by specialists: certified ISO 22301 BCM managers carry out your BIA
- With an auditor’s view: from ISO 22301 audits for an accredited certification body, we know what evidence an auditor expects for the BIA
- Your team can do it alone afterwards: method and templates stay with you, and you update the next BIA without us
- One BIA for several obligations: suitable for ISO 22301, NIS‑2, DORA and the CER Directive
Frequently asked questions about the business impact analysis
The BIA determines which business processes are time-critical, how long they may be down and which resources they need for recovery. It is the basis for your BCM strategy and for all contingency and recovery plans.
Your organisation is ready for the BIA when the scope, process map, impact criteria, method and responsibilities are defined. Without them, the workshops deliver results that cannot be compared across departments. In the readiness assessment we close these gaps before the first BIA starts.
The risk analysis asks how likely an event is and how you prevent it. Regardless of the cause, the BIA asks what consequences an outage has over time and how quickly a process must be running again. ISO 22301 requires both. For the risk analysis we offer a separate cyber security risk assessment.
The maximum tolerable period of disruption (MTPD) is the point after which an outage is no longer acceptable for your company. The recovery time objective (RTO) comes before it and defines when the process must be running again, at least in emergency mode. The recovery point objective (RPO) determines how much data you can afford to lose, and therefore how often you need to back up.
Article 11 of DORA explicitly requires a business impact analysis for severe business disruptions. NIS‑2 requires measures for business continuity and crisis management but does not prescribe a method. Without a BIA, however, it is hard to justify which measures are sufficient. For ISO 22301 it is mandatory.
For each process we hold one workshop with the people who know the process. We prepare the questionnaires and templates and take care of the evaluation. We often start with the core processes of one site or business unit and then extend the BIA step by step.
The effort depends mainly on the number of sites and business processes, the state of your process documentation and whether you commission only the readiness assessment or the first BIA as well. An existing ISMS or existing contingency plans reduce the effort.
From the results you derive your BCM strategy and your contingency and recovery plans. You implement them yourself or with our ISO 22301 consulting through to certification. You review the BIA regularly and after major changes, as ISO 22301 requires.
Start your business impact analysis
In the free initial conversation we clarify scope and approach.