CompTIA Security+ Preparation · lesson 41 of 45 · 25 min
Business Impact Analysis (BIA)
A Business Impact Analysis (BIA) identifies critical business functions and the impact of disruptions. It is the foundation of Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP).
BIA process: 1. Identify critical business functions. 2. Identify supporting IT systems. 3. Determine the impact of disruption (financial, operational, reputational). 4. Establish RTO and RPO for each function. 5. Identify dependencies.
RTO (Recovery Time Objective) — maximum acceptable downtime. How quickly must a system be restored? Example: payment processing RTO = 4 hours.
RPO (Recovery Point Objective) — maximum acceptable data loss. How much data can be lost? Example: database RPO = 1 hour (backups must run at least hourly).
MTBF (Mean Time Between Failures) — average time between system failures. Used to predict reliability. Higher MTBF = more reliable.
MTTR (Mean Time to Repair/Recover) — average time to restore a failed system. Lower MTTR = faster recovery.
SLA (Service Level Agreement) — contractual commitment to uptime and performance. Defines penalties for violations. Example: 99.9% uptime SLA = max 8.7 hours downtime per year.
Critical Asset Identification
Critical assets — systems, data, and processes whose disruption would significantly impact business operations. Identified during BIA.
Single point of failure (SPOF) — a component whose failure causes the entire system to fail. BIA identifies SPOFs so they can be eliminated through redundancy.
Dependencies — systems that rely on other systems. Example: the payment system depends on the database, which depends on the network, which depends on the ISP. BIA maps these dependencies.
Impact categories: Financial (revenue loss, fines), Operational (inability to deliver services), Reputational (customer trust), Legal/Regulatory (compliance violations), Safety (physical harm).
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Business Impact Analysis
The primary purpose of a BIA is to:
- Identify security vulnerabilities
- Identify critical business functions and the impact of disruptions
- Create a disaster recovery plan
- Conduct a penetration test
- Answer: Identify critical business functions and the impact of disruptions
BIA identifies what is critical, what depends on what, and what the business impact of losing each function would be. If a company’s RPO is 2 hours, backups must run:
- Every 24 hours
- Every 8 hours
- At least every 2 hours
- Once a week
- Answer: At least every 2 hours
RPO = maximum data loss. If RPO is 2 hours, you cannot afford to lose more than 2 hours of data — backups must run at least every 2 hours. MTBF measures:
- How long it takes to repair a system
- The average time between system failures
- The maximum acceptable downtime
- The cost of a failure
- Answer: The average time between system failures
MTBF = Mean Time Between Failures. Higher MTBF means the system fails less frequently — more reliable. A Single Point of Failure (SPOF) is eliminated through:
- Better documentation
- Redundancy
- Faster patching
- More monitoring
- Answer: Redundancy
SPOFs are eliminated by adding redundant components — if one fails, the redundant component takes over. An SLA of 99.9% uptime allows a maximum of:
- 52 minutes downtime per year
- 8.7 hours downtime per year
- 1 day downtime per year
- 30 minutes downtime per month
- Answer: 8.7 hours downtime per year
99.9% uptime = 0.1% downtime = 8.76 hours per year. 99.99% = 52 minutes. 99.999% = 5 minutes. MTTR measures:
- Average time between failures
- Average time to restore a failed system
- Maximum acceptable downtime
- Time to detect an incident
- Answer: Average time to restore a failed system
MTTR = Mean Time to Repair/Recover. Lower MTTR means faster recovery — a key metric for incident response and operations. BIA dependency mapping identifies:
- Security vulnerabilities
- Systems that rely on other systems — failure cascades
- User access rights
- Network topology
- Answer: Systems that rely on other systems — failure cascades
Dependency mapping shows how failures cascade — if the database fails, what else fails? This drives recovery prioritization.
Which impact category includes customer trust damage?
- Financial
- Operational
- Reputational
- Legal
Answer: Reputational
Reputational impact includes damage to customer trust, brand value, and public perception — can have long-term financial consequences.
RTO is set during:
- A penetration test
- A Business Impact Analysis
- A vulnerability scan
- An incident response
- Answer: A Business Impact Analysis
BIA establishes RTO and RPO for each critical function — these drive the design of backup and recovery systems.
BIA stands for Business _____ Analysis.
Answer: Impact
BIA = Business Impact Analysis — the process of identifying critical functions and quantifying the impact of their disruption.
Try it: BIA metrics
Previous lesson: Security audits and assessments: internal, external, penetration test, vulnerability assessment
Back to CompTIA Security+ Preparation
Next lesson: Data privacy concepts and data classification