ISO/TS 22317:2021 provides guidance for establishing and maintaining a formal Business Impact Analysis process. It is especially useful for organizations that need consistency across many services, business units or facilitators. It complements ISO 22301 rather than replacing the BCMS requirements standard.
What this means in practice
Design the BIA method before collecting data. Define what is being analyzed, impact categories, time bands, recovery terms, dependency depth, approval and review triggers. Otherwise two facilitators can produce incompatible meanings for “critical,” “maximum outage” or “four-hour recovery.”
Decision and evidence map
| Area | Practical question | Evidence |
|---|---|---|
| Unit of analysis | Are we prioritizing services, processes, activities or a combination? | Defined scope and hierarchy |
| Impact criteria | How are people, regulatory, customer, financial and operational impacts assessed? | Scales and examples |
| Time | How does impact escalate as interruption lasts? | Defined time bands |
| Recovery terms | How are MTPD/MAO, RTO, MBCO and RPO used? | Controlled glossary/method |
| Dependencies | How specifically are resources mapped? | Named systems, suppliers, sites and roles |
| Approval | Who validates requirements and who validates capability? | Business and support-owner approvals |
Practical implementation checklist
- Define the BIA method, terminology and quality rules centrally.
- Train facilitators to challenge unsupported targets.
- Use time-based impact rather than asking only whether an activity is critical.
- Keep recovery requirement separate from current capability.
- Link dependencies to the recovery stage at which they are needed.
- Retain owner approval, source date and assumptions.
- Trigger review after material service, system, supplier or obligation change.
Worked example
A business requires a four-hour service recovery based on impact, while technology currently demonstrates eight hours. The BIA should keep four hours as the requirement. The eight-hour value belongs in capability evidence and the difference becomes a visible recovery gap. Changing the BIA to eight hours would erase information management needs to make a decision.
Common mistakes
- Launching enterprise BIA before agreeing terminology.
- Letting facilitators use different impact scales by department.
- Adjusting recovery requirements to match existing capability.
- Collecting dependency names without owners or recovery timing.
- Reviewing annually without event-driven triggers.
Governance, review and improvement
Use BIA output to drive continuity strategy, plans, DR priorities, supplier assurance and exercise objectives. The BIA is not complete when the questionnaire is approved; its value is realized when downstream recovery decisions use the requirements consistently.
Authoritative references
BCM.Center paraphrases standards and guidance; use the official publication for authoritative wording and current status.
Frequently asked questions
Is ISO/TS 22317 the certifiable BCMS standard?
No. It provides BIA guidance; ISO 22301 contains BCMS requirements commonly used for certification.
Does it prescribe one BIA template?
No. Organizations can design a method appropriate to their context while keeping analysis consistent and documented.
Can BIA be automated?
Data collection and consistency checks can be automated, but impact judgments and approval require accountable human validation.
Should BIA analyze services or processes?
Either structure can work; the unit should support the organization’s service outcomes and dependency/recovery decisions.
What comes after BIA?
Continuity strategy, capability-gap management, planning and exercises should use the approved recovery requirements.