What is a business impact analysis (BIA) and its purpose?

• A. The BIA inventories all assets with ownership assignments.
• B. The BIA defines incident response roles and runbooks.
• C. The BIA identifies critical functions and assesses impact of disruptions to prioritize recovery efforts and resources.
• D. The BIA describes data backup schedules.

Answer: (C)

A business impact analysis centers on identifying which business functions are essential and how disruptions would affect them. By examining processes, dependencies (systems, data, people, suppliers), and the potential consequences in financial, operational, regulatory, and reputational terms, a BIA helps determine how long the business can tolerate downtime and how much data loss is acceptable. This information guides setting recovery objectives—what must be restored and how quickly—and informs where to prioritize recovery efforts and resources. The BIA isn’t just a list of assets, nor is it about assigning incident response roles or scheduling backups—that broader planning comes from asset management, IR planning, and backup/DR activities, while the BIA specifically defines critical functions and the impact of disruptions to drive recovery priorities.