Business impact analysis (BIA) in business continuity management: a guide for mid-sized companies

Key takeaways (at a glance)

• A business impact analysis (BIA) is the basis for effective business continuity management and structured emergency management in mid-sized companies.
• For organisations under NIS2 or DORA and for those certified to ISO 27001, a systematic impact analysis is effectively mandatory.
• Without a BIA, companies know neither their recovery times nor the actual damage and priorities in a crisis.
• This article provides a concrete roadmap with steps, roles, key figures and notes on communication.

What is a business impact analysis (BIA), and why is it indispensable in 2026?

The business impact analysis is the systematic assessment of the impact caused by the interruption of key business processes. The BIA identifies an organisation’s critical business processes and assesses potential damage such as financial losses, legal consequences, operational disruption and reputational damage. A BIA is a central part of business continuity management (BCM) and feeds directly into emergency plans, recovery plans and the emergency organisation.

For mid-sized companies in Germany, Austria and Switzerland, vulnerability is particularly high: limited resources, heavy dependence on IT systems and on individual key people, and less formalised processes increase the risks. How quickly this becomes expensive is shown by the ransomware attack on the napkin manufacturer Fasana (opens in a new tab) in May 2025: according to media reports, orders worth around 250,000 euros went unfulfilled on the day after the attack alone, and around two million euros in revenue were lost over the following two weeks. An impact analysis defines in advance which processes have to run again first and what each day of downtime costs.

The BIA is not an academic exercise but a basis for decisions: which processes have to run again first? How much data loss is tolerable? Which resources are available? Without this information, every risk mitigation strategy is flying blind.

Regulatory requirements: business impact analysis for NIS2, ISO 27001 and more

Regulations are massively increasing the pressure for structured business continuity management. The most important requirements at a glance:

• NIS2 (EU directive, to be transposed by 17 October 2024; in force in Germany since 6 December 2025): essential and important entities must take measures to keep operations running — such as backup management and disaster recovery — and for crisis management. A systematic impact analysis is the usual basis for this.
• ISO/IEC 27001:2022: Control A.5.30 requires ICT readiness to be planned, implemented and tested on the basis of the business continuity objectives — objectives that in practice come from a BIA. In an audit you should be able to show that defined values such as RTO and RPO are technically achievable.
• BSI Standard 200-4: Describes the BIA as a core element of a BCMS and provides a maturity-based framework with requirements for each level.
• Sector-specific: MaRisk and DORA (opens in a new tab) (financial sector), KRITIS, healthcare and cyber insurers require evidence of recovery times and compliance with information security.

For organisations in scope, an inadequate BIA can lead to breaches of their obligations — and even where no formal regulation applies, customers and supervisory authorities increasingly expect reliable data.

Typical risks without a sound business impact analysis

“Nothing has happened so far” is no indicator of resilience. Without a BIA, critical business processes cannot be identified, and the organisation has no signposts in an emergency. An inadequate BIA leads to ineffective emergency strategies and to the following concrete risks:

• Financial losses: An inadequate BIA can lead to considerable financial losses — production outages, contractual penalties, lost sales.
• Reputational damage: A missing BIA increases the risk of reputational damage, especially when disruptions are visible to customers.
• Compliance breaches: Reporting obligations, deadlines, data protection requirements — without defined objectives and key figures, sanctions loom.
• Data loss: Without a defined RPO, uncontrolled data loss can jeopardise the entire recovery process.

The BIA assesses financial, legal and reputational damage and sets the maximum tolerable period of disruption (MTD/MTPD). Without this assessment there is no basis for any reliable planning — from risk assessment to negotiations with cyber insurers.

The difference: business impact analysis vs. risk analysis and risk management

A common misconception: “We have a risk register, so we don’t need a BIA.” The distinction, however, is clear:

The BIA only assesses the impact of process outages. Risk analysis, on the other hand, identifies potential sources of danger and their likelihood. The BIA helps to set priorities for recovery — risk management lowers the likelihood of threatening events.

Both disciplines should be linked organisationally: joint workshops, a shared data basis and aligned reports to management make sure that both analyses fit together.

Step by step: how a business impact analysis is carried out in practice

The following roadmap is aimed at mid-sized companies setting up a BIA for the first time or again in 2026:

1. Project start and scope definition: Clearly define the scope — start with core processes such as order processing, production, IT service desk, email communication and payments.
2. Identification of business processes: Capture all relevant processes, including support processes and IT infrastructure. Dependencies between processes and resources must be analysed.
3. Assessing the business impact over time: Estimate the damage over hours, days and weeks — financial, operational, legal, reputational.
4. Defining RTO, RPO and MTD: For each process, set the maximum tolerable period of disruption (MTD/MTPD) and derive the recovery time objective (RTO) from it, plus the tolerable data loss (RPO). These values determine the order in which the processes are brought back up.
5. Consolidation and management approval: Present the results in a table or dashboard so that management can quickly see the insights and priorities.

NICA

Interviews and workshops are part of the BIA process. Use standardised questionnaires rather than unstructured email requests. A table with columns for process name, criticality, RTO, RPO, MTD, dependencies and estimated damage works well as a template.

NICA

Roles, responsibilities and involving the business units

The BIA requires the involvement of different roles within the organisation — it must not be treated as a purely IT or compliance topic. Typical core roles:

• Management: Sponsor, prioritisation, approval and budget responsibility
• Business continuity manager / emergency manager: Methodology, coordination, facilitation
• Head of IT: Technical feasibility, availability of assets and IT systems
• Business units (sales, production, logistics, customer service): Knowledge of the actual processes, dependencies and manual workarounds
• Risk management and information security: Link to the ISMS and risk assessment
• Finance and HR: Financial impact, resources and staff shortages

Define communication channels: regular meetings, central document storage, defined channels via email distribution lists or collaboration tools — and, for emergencies, a channel that works without email, such as an alerting app. Responsibilities and escalation paths should be documented in writing as part of BCM and reviewed annually.

Integrating the BIA into business continuity management and continual improvement

The BIA is a continuous process that has to be updated regularly. The results of the BIA feed into the business continuity plan and are translated into concrete solutions:

• Emergency strategies per process: Alternative sites, replacement systems, manual workarounds, a defined order of recovery
• Tests and emergency exercises: Annual tabletop exercises (e.g. failure of the email infrastructure), technical recovery tests for central components
• Review when things change: New sites, cloud migration, M&A transactions or new regulatory requirements should trigger a BIA review — at least once a year

Living BCM with an up-to-date BIA increases resilience, meets compliance requirements and enables the organisation to stay in control and able to act even in complex crises. Because the BIA contains sensitive information, it belongs in the ISMS confidentiality concept.

NICA

FAQ on the business impact analysis (BIA)