Every business continuity management system rests on one analysis: which activities matter, how quickly they must resume, and what they depend on. Get the business impact analysis right and the plans write themselves; get it wrong and you produce recovery plans for the wrong things. 88 editable files across eight clause-aligned sections, downloadable the moment you check out. On this page:
- What is in the business impact analysis pack
- What the business impact analysis has to establish
- Who needs business impact analysis
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the business impact analysis pack
The sections follow clauses 4 to 10 of the standard, with an implementation section at the front:
- 00 Implementation Resources – the project plan, awareness presentations and the sequencing guidance
- 04 Context of Organization – internal and external issues, interested parties and their requirements, and the BCMS scope
- 05 Leadership – the business continuity policy, roles and responsibilities and the management commitment record
- 06 Planning – risks and opportunities, business continuity objectives and planning of changes
- 07 Support – resources, competence, awareness, communication and control of documented information
- 08 Operations – the business impact analysis and risk assessment, continuity strategies and solutions, the business continuity plans themselves, incident response structure, warning and communication, and the exercise programme
- 09 Performance Evaluation – monitoring and measurement, internal audit and management review
- 10 Improvement – nonconformity, corrective action and continual improvement
- Workbooks throughout – 28 Excel tools including the BIA workbook, dependency mapping, RTO and RPO determination and the exercise tracker
What the business impact analysis has to establish
ISO 22301:2019 is current, amended in 2024 to add consideration of climate change. The standard is at committee draft stage for revision, so a new edition is coming but is not here yet.
The analysis has to produce specific outputs, not a general sense of criticality: the recovery time objective for each prioritised activity, the recovery point objective for the data behind it, the minimum business continuity objective you must maintain, and the dependencies – people, premises, technology, information, suppliers – that resumption relies on.
Those outputs then drive everything downstream. A continuity strategy is only assessable against the RTO it is meant to meet, and an exercise only proves something if it tests against the business impact analysis rather than against a comfortable scenario. That is why the BIA workbook here is a structured tool rather than a form.
Who needs business impact analysis
Organisations certifying to ISO 22301, usually because a customer or regulator requires it. Financial entities meeting continuity expectations under DORA or national rules. Organisations that have had an outage and discovered their plans addressed the wrong dependencies. And those with plans written years ago that have never been tested against a current dependency map.
How the business impact analysis maps to the framework
Continuity documentation fails in a predictable way: the plans are written for scenarios rather than for impacts. A plan for a fire and a plan for a ransomware event have the same practical content if the impact is the same – the building is unavailable, or the systems are. Structuring around the business impact analysis rather than around scenarios keeps the plan set small enough to maintain and broad enough to be useful.
Frequently asked questions
Which edition is this written to?
ISO 22301:2019 with the 2024 amendment adding consideration of climate change. A revision is at committee draft stage but has not been published.
What is the difference between RTO and RPO?
Recovery time objective is how quickly an activity must resume. Recovery point objective is how much data loss is tolerable, measured backwards from the disruption. Both come out of the BIA.
Does this include the actual continuity plans?
Yes – incident response structure, warning and communication, and the plan templates, alongside the exercise programme that tests them.
How does this relate to DORA?
DORA imposes operational resilience requirements on EU financial entities that go beyond ISO 22301 but overlap substantially. See the DORA Toolkit.
How many documents are included?
88 editable files – 58 Word documents, 28 Excel workbooks and 2 presentations – plus a licence file.
Related toolkits
Continuity sits alongside security and quality systems. See the ISO 27001 Toolkit, which shares the same management system clauses, the DORA Toolkit for EU financial entities, the ISO 9001 Toolkit for quality and the ISO 31000 Toolkit for the enterprise risk framework. The ISO 22301 gap assessment is a quick way to size the work before starting on the documentation.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your business impact analysis downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the business impact analysis are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet