Business Impact Analysis (BIA)

Business Continuity Risk Management ISO 22301 Compliance

Overview

Conduct structured Business Impact Analyses per ISO 22301. The skill guides the agent through structured interviews with process owners, builds a dependency map across departments, determines RTO and RPO targets, and validates everything with automated tools that catch timing conflicts and circular dependencies before they become real problems.

Getting Started

Activate the Business Impact Analysis (BIA) skill and tell the agent which business units or processes are in scope. The agent will walk you through structured interviews for each process, populate a machine-readable data file, and run automated validation checks.

Example Conversation

You: We need a BIA for our main business units — Sales, IT Infrastructure, HR, Finance, and Support. Start with the critical processes.

Agent: I’ll start by gathering information for each department. Let’s begin with Sales — what are the key processes, and what happens financially if Order Processing goes down for 4 hours?

You: Order Processing is critical — we lose about $50k per hour. It depends on the ERP system in IT.

Agent: Got it. I’ve added Order Processing as PROC-001 (critical, Sales). Now let me ask about the ERP system and the rest of the dependency chain…

After collecting all process data, the agent runs validation:

Agent: I’ve run both validation tools on the BIA data. Here’s what I found:
ERROR: Order Processing claims RTO of 2h but depends on ERP System which has RTO of 8h — it can’t recover before its dependency
WARNING: Payroll is rated ‘high’ criticality but has a 48h RTO, which exceeds the typical 24h threshold for that tier
Circular dependency detected: Reporting Dashboard and Data Warehouse depend on each other — this must be resolved
Let’s fix these one by one. Should we adjust the ERP System’s RTO or Order Processing’s?

What the Tools Validate

The skill includes two automated validation tools that run against the structured BIA data:

bia_rto_calculator checks five consistency rules:

No process claims an RTO shorter than its slowest upstream dependency
No RPO shorter than the RPO of data-providing dependencies
Critical processes stay within expected tier thresholds (critical ≤ 4h, high ≤ 24h, etc.)
RPO does not exceed RTO without explicit justification
High-criticality processes do not silently depend on lower-criticality ones

dependency_loop_checker validates the dependency graph:

Detects circular dependencies that would make RTO calculations meaningless
Reports unknown or broken dependency references
Maps cross-department dependency links for coordination planning

Output Excerpt

The final BIA report includes a process inventory, impact-over-time matrix, validated dependency map, and actionable recommendations:

| ID       | Process          | Dept  | Criticality | RTO  | RPO   |
|----------|-----------------|-------|-------------|------|-------|
| PROC-001 | Order Processing | Sales | Critical    | 8h   | 1h    |
| PROC-002 | ERP System       | IT    | Critical    | 8h   | 1h    |
| PROC-003 | Database Cluster | IT    | Critical    | 1h   | 0.25h |
| PROC-004 | Payroll          | HR    | High        | 24h  | 4h    |

All RTO/RPO values are validated against the dependency chain — no process claims a recovery time its dependencies can’t support.