> For the complete documentation index, see [llms.txt](https://intuitem.gitbook.io/ciso-assistant/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://intuitem.gitbook.io/ciso-assistant/guides/assessments/bia.md).

# Conducting a Business Impact Analysis

Step-by-step walkthrough for conducting a Business Impact Analysis

A **Business Impact Analysis** (BIA) measures how badly the organisation hurts when an asset stops working — and how quickly that hurt escalates. Where a risk assessment asks *"what could go wrong?"*, a BIA asks *"if it does, how bad is it after one hour, after one day, after one week?"*.

See [Business impact analyses](/ciso-assistant/concepts/assets-and-resilience/business-impact-analyses.md) for the underlying object model.

{% hint style="info" %}
BIAs live under **Assets management → Business Impact Analysis** in the sidebar. They're gated by the `bia` feature flag — see [Feature flags](/ciso-assistant/configuration/settings/feature-flags.md).
{% endhint %}

## Prerequisites

* The `bia` feature flag is on.
* A **perimeter** representing the scope you're analysing (a service, a process, a department). Create one via [Perimeters](/ciso-assistant/concepts/foundations/perimeters.md) if needed.
* **Assets** in scope. Assets must already exist in the inventory — the BIA flow doesn't create them. See [Assets](/ciso-assistant/concepts/assets-and-resilience/assets.md).
* A **risk matrix** with an impact scale you want to reuse for severity levels. Any enabled matrix from your library will do.

## Big picture: the BIA object graph

A BIA is a thin envelope with three nested layers — each one becomes a separate row in the timeline:

```
Business Impact Analysis
└── Asset assessment (one per asset in scope)
    └── Escalation threshold (one per "step in time")
```

| Object                   | What it captures                                                                                                                                               |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **BIA**                  | Perimeter, risk matrix, due date, authors, reviewers, lock status.                                                                                             |
| **Asset assessment**     | One asset in the BIA: its dependencies, the controls protecting it, the evidences, the recovery readiness checklist (`documented` / `tested` / `targets met`). |
| **Escalation threshold** | "At T+*n* minutes/hours/days, the impact becomes *X*." Several per asset to build the time curve.                                                              |

## Step 1 — Create the BIA

1. From the sidebar, open **Assets management → Business Impact Analysis**.
2. Click **Start a BIA**.
3. Fill in the form:
   * **Folder** — the domain this BIA belongs to. Drives IAM scoping.
   * **Perimeter** — the scope of the analysis. Selecting a perimeter auto-fills the folder if it was empty.
   * **Version** — e.g. `0.1` (default), `1.0` once formally approved.
   * **Status** — initial assessment status (Draft, In progress, etc.).
   * **Risk matrix** — the matrix that supplies the impact scale used by escalation thresholds.

     <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p>Changing the risk matrix <em>after</em> thresholds exist auto-clamps each threshold's <code>quali_impact</code> to the new scale (between <code>min_impact</code> and <code>max_impact</code>). The values won't be lost, but <strong>you should review them</strong> — a 4 on a 5-step scale isn't the same severity as a 4 on a 10-step scale.</p></div>
   * **Due date** — when this must be completed.
   * **Authors** — actors writing the BIA.
   * **Reviewers** — actors expected to review/approve.
4. *Optional*: expand the **More** dropdown to set:
   * **Locked** — when on, no one can edit this BIA or its asset assessments. Use after sign-off to freeze the dossier.
5. **Save**.

## Step 2 — Include assets in the BIA

The BIA detail page opens with the standard `DetailView` plus a **Recovery insights** sidebar widget (it'll show 0% until you populate things) and an **Asset assessments** table below.

For each asset you want in scope:

1. Click **Include asset** (the create button on the asset-assessments table).
2. Fill in:
   * **Asset** — pick the asset; one BIA can't have the same asset twice (`unique_together = ["bia", "asset"]`).
   * **Extra dependencies** — additional assets whose disruption would propagate here. The primary/supporting relationships already declared on the asset are picked up automatically; only add dependencies that aren't already modelled.
   * **BIA** — pre-filled and hidden when adding from the BIA's table.
   * **Associated controls** — controls specifically designed to improve *this* asset's resilience (e.g. backup job, failover, runbook). These are separate from controls already attached to the asset elsewhere.
   * **Recovery documented** — checkbox. Is there a written recovery procedure?
   * **Recovery tested** — checkbox. Has it been exercised recently?
   * **Recovery targets met** — checkbox. Did the test hit RTO/RPO?
   * **Evidences** — backup tests, DR exercise reports, BCP excerpts.
   * **Observation** — Markdown notes.
3. **Save**.

Each asset assessment surfaces as a row in the BIA's timeline.

{% hint style="info" %}
The three recovery checkboxes drive the **Recovery insights** activity tracker on the BIA header. Each one shows a percentage across all assets in the BIA — your dashboard of "how ready are we" at a glance.
{% endhint %}

### Add many assets at once

To cover a large scope without filling the form once per asset, use the **Batch add assets** button (layer-group icon next to the create button on the **Asset assessments** table):

1. A picker opens, listing only the assets not yet included in this BIA — with search and pagination (**Show** 10 / 25 / 50 / 100 **entries** per page).
2. Tick assets on the current page — **Select all** ticks the visible page. The selection always matches what you see: changing page or search clears it.
3. Click **Batch add assets**. One asset assessment is created per selected asset and a toast confirms the count. The picker stays open and the added assets drop out of the list, so a larger scope is covered page by page, confirm by confirm — then **Close**.

Batch-added assessments start empty — recovery flags unchecked, no extra dependencies, controls, or evidences — so refine each one afterwards. Duplicates are impossible: assets already covered by the BIA are simply not offered again. On a locked BIA the add buttons are hidden, like the removal checkboxes.

### Remove many assets at once

To shrink the scope, tick rows on the **Asset assessments** table and click **Delete** in the toolbar that appears — the same batch action available on other tables. The confirmation dialog recaps how many rows are selected and asks you to type *yes*; deleting an assessment also deletes its escalation thresholds. The **Recovery insights** widget refreshes afterwards. On a locked BIA the checkboxes are unavailable.

### Toggle the recovery flags from the table

Right-click a row of the **Asset assessments** table to flip **Recovery documented**, **Recovery tested**, or **Recovery targets met** without opening the edit form. Each menu entry shows the flag's current state; a click toggles it and refreshes the table and the **Recovery insights** widget. On a locked BIA these entries are disabled.

## Step 3 — Add escalation thresholds (the time curve)

For each asset assessment, capture how the impact evolves over time. Open the asset assessment's detail page and add thresholds via **Add a step**:

1. **Point in time** — a duration since the start of the disruption. Use the duration picker (days / hours / minutes). Stored internally in seconds. Each `(asset_assessment, point_in_time)` pair must be unique.
2. **Asset assessment** — pre-filled and hidden when adding from inside an asset assessment.
3. **Qualifications** — multi-select from the `qualifications` [terminology](/ciso-assistant/concepts/specialised-modules/terminology.md) (e.g. *financial*, *operational*, *regulatory*, *reputational*). Tags what *kind* of impact this threshold describes.
4. **Impact** — qualitative impact level, picked from the BIA's risk matrix impact column.
5. **Justification** — free-text rationale.

Build up several thresholds per asset to draw a step curve: *at T+15min: low; T+1h: medium; T+4h: high; T+24h: critical*.

A threshold's impact is **carried forward** until the next threshold — between two threshold points, the curve plateaus at the most recent severity. Before the first threshold, the asset is rendered as `--` (not rated).

## Step 4 — Read the timeline (Impact over time)

From the BIA detail page, click **Impact over time** in the actions column. The page renders the **TimelineTable**:

* Rows: each asset assessment in the BIA.
* Columns: each unique `point_in_time` across the whole BIA (so all rows share an x-axis).
* Cells: the impact severity at that point, colour-coded by the risk matrix.

This is the key output you'll show to stakeholders — at a glance, "if X breaks, here's how the room turns red as time passes".

## Step 5 — Generate the Report

The **Report** button (in the actions column) produces a printable summary:

* BIA header (name, version, status, reference scale).
* Assets included.
* The Impact-over-time TimelineTable.
* **Recovery insights** activity tracker (documented / tested / objectives met percentages).
* **Asset Assessment Status** table — green/grey check icons per asset on the three recovery flags.
* **Objectives vs Capabilities** comparison — per asset, the security objectives and recovery objectives declared on the asset *vs* the capabilities reported on it, with an **Alignment** verdict (✓ when all aligned, ✗ if any objective isn't met).

Use the **Export PDF** button to print to PDF.

## Step 6 — Export to Excel

For round-trip editing or sharing with people who live in Excel, the actions column also has an **Export → as Excel** option. Goes through `/business-impact-analysis/{id}/export/xlsx`.

## Step 7 — Lock the BIA after sign-off

Once the BIA has been reviewed and accepted, edit it and switch on the **Locked** checkbox in the **More** dropdown.

Effects:

* The detail page shows a yellow banner: *"Assessment Locked — This assessment is locked."*
* Create / Edit / Delete actions are disabled on the BIA and all its asset assessments and escalation thresholds.
* Unlock the same way (uncheck **Locked**) when you start a new revision.

## Step 8 — Request validation (optional)

If the `validation_flows` feature flag is on, the actions column shows a **Request validation** button (hidden when the BIA is locked). It triggers the standard approval workflow — see [validation flows](/ciso-assistant/introduction/vocabulary.md#v).

## Best-practice sequence

1. Build the asset inventory first; the BIA reads, it doesn't create.
2. Use the **primary/supporting** relationships on assets to model upstream dependencies — the BIA will pick them up for free. Reserve **Extra dependencies** on the asset assessment for things not modelled elsewhere.
3. Pick a risk matrix early and **don't switch matrices** mid-flow unless you're prepared to re-score every threshold.
4. Capture thresholds at organisationally meaningful steps (e.g. SLA breakpoints, regulatory notification windows) rather than evenly spaced.
5. Keep **Authors** small (people who write) and **Reviewers** wider (people who sign off). Lock after the reviewers approve.

## What's next

* Feed the timeline into your [risk assessments](/ciso-assistant/concepts/risk/risk-assessments.md) — the same asset criticality should drive scenario prioritisation.
* For DORA-regulated entities, the BIA output supports DORA incident-reporting workflows. See [framework-specific features → DORA](/ciso-assistant/features/framework-specific/dora.md).
* Track the recovery readiness numbers on the **Recovery insights** widget over time as you close gaps.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://intuitem.gitbook.io/ciso-assistant/guides/assessments/bia.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.