# Business impact analysis (BIA) worksheet

A blank worksheet for practicing a business impact analysis, the first competency in domain 4 of PECB's ISO 22301 Lead Implementer exam ("Ability to plan and conduct a business impact analysis (BIA)", Candidate Handbook, version 1.5, read on 2 October 2026). The columns are our suggestion. The time terms follow NIST Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems; your course and ISO 22301 may name them differently, so use the names your course uses. This worksheet does not reproduce ISO 22301.

## 1. The activity

| Field | Your answer |
|---|---|
| Activity or process | |
| Owner | |
| What it delivers, and to whom | |
| When it matters most (month end, peak season, a deadline) | |

## 2. Impact over time

Rate each impact if the activity stopped completely: 0 none, 1 minor, 2 significant, 3 severe. Write one line on why.

| Time since disruption | Financial | Customers | Legal or regulatory | Reputation | Staff and safety | Why |
|---|---|---|---|---|---|---|
| 4 hours | | | | | | |
| 1 day | | | | | | |
| 3 days | | | | | | |
| 1 week | | | | | | |
| 2 weeks | | | | | | |
| 1 month | | | | | | |

Change the time bands to suit the activity. A payments process may need minutes; a quarterly report may need weeks.

## 3. The three numbers

| Term (NIST SP 800-34) | What it means | Your figure |
|---|---|---|
| Maximum tolerable downtime (MTD) | The total time the business will accept the activity being disrupted, all impacts considered | |
| Recovery time objective (RTO) | The longest a resource can stay unavailable before the impact on the activity, and on the MTD, becomes unacceptable | |
| Recovery point objective (RPO) | The point in time before the disruption to which data can be recovered; it measures how much data loss the activity can tolerate | |

Check: NIST notes that the RTO must normally be shorter than the MTD. If yours is not, the recovery plan cannot meet the business need.

## 4. What the activity depends on

| Dependency | Type (people, site, IT system, data, supplier, partner) | Workaround if it fails | Workaround lasts how long |
|---|---|---|---|
| | | | |
| | | | |
| | | | |
| | | | |

## 5. Minimum to keep going

| Field | Your answer |
|---|---|
| Lowest level of output the business could accept during a disruption | |
| Staff needed at that level | |
| Systems and data needed at that level | |
| Who must be told, and how fast (customers, regulators, partners) | |

## 6. Sign-off

| Field | Your answer |
|---|---|
| Reviewed by the activity owner | |
| Date | |
| Next review | |

Credential Press is independent of PECB and ISO. This worksheet is a study aid, not a substitute for your organization's BIA method.