Module 3 · Business Impact Analysis — Deriving RTO and RPO
Manish GargAssociate of (ISC)² · RingSafe
May 14, 20263 min read
Read as
100% Free
No signup. No paywall. No catch.One of our 10 most-requested practitioner modules — published in full so anyone can learn for free. We earn through consulting, not by gating knowledge.
Why this module exists. Business Impact Analysis (BIA) is the foundation of any BCDR programme — without it, every recovery decision is uninformed. This module covers BIA methodology, how to derive RTO and RPO objectives from impact analysis, and the documentation that makes a BCDR programme audit-defensible.
Why this module exists. BIA produces the answer to the most important BCDR question: “what does it cost the business if this system is down?” Without that answer, you cannot prioritise recovery, size investments, or set recovery objectives. This module is the BIA practitioner workflow.
What BIA produces
For each business function and supporting IT system, BIA delivers:
RTO (Recovery Time Objective) — maximum acceptable time the function can be unavailable.
RPO (Recovery Point Objective) — maximum acceptable data loss measured in time.
MTPD (Maximum Tolerable Period of Disruption) — beyond which the business cannot recover at all.