Business Continuity
Disaster Recovery Planning: RTO, RPO and When DRaaS Makes Sense
Disaster recovery is an insurance policy whose value depends entirely on whether it works. How to tier systems, choose DR options and test them properly.
Key takeaways
- The BIA identifies which activities matter most and how fast they must recover.
- Use consistent impact criteria across financial, regulatory, customer and safety dimensions.
- Map dependencies on people, systems, suppliers and sites.
- Validate results with senior leadership before investing in recovery.
Purpose of a BIA
A business impact analysis assesses the effect of disruption on activities over time. It sets the recovery priorities and objectives that drive continuity strategies and IT disaster recovery investment.
Key terms
| Term | Meaning |
|---|---|
| MTPD | Maximum tolerable period of disruption before impacts become unacceptable |
| RTO | Recovery time objective — target time to resume an activity or system |
| RPO | Recovery point objective — maximum acceptable data loss, measured in time |
| MBCO | Minimum business continuity objective — the minimum acceptable level of service |
Step by step
- Define impact criteria — financial loss, regulatory breach, customer harm, reputation, safety — with thresholds per level.
- List activities for each department, focusing on products and services delivered.
- Interview owners using a structured template; avoid long surveys without discussion.
- Assess impacts over time — at 4 hours, 1 day, 3 days, 1 week and beyond.
- Set MTPD and RTO where impacts become unacceptable.
- Capture dependencies — applications, data, suppliers, key staff, equipment, sites.
- Determine RPO for the data each activity relies on.
- Consolidate and challenge — resolve inconsistencies across departments.
- Validate with executive management and record approval.
Translating BIA to IT recovery
Aggregate the RTOs and RPOs of activities to the applications they depend on. The strictest requirement wins, and supporting infrastructure — identity, network, DNS — inherits it. Compare with current capability to identify the gap.
Pitfalls
- Every department claims everything is critical — impact criteria prevent this.
- RTOs set without understanding cost.
- Forgetting manual workarounds that can extend tolerance.
- BIA not refreshed after major organizational change.
Sample impact scale
| Level | Financial | Regulatory | Customer |
|---|---|---|---|
| 1 Minimal | Negligible | None | Unnoticed |
| 3 Moderate | Material but absorbable | Reportable | Noticeable complaints |
| 5 Severe | Threatens viability | Sanctions or licence risk | Widespread harm |
How NAZZTEC helps
We facilitate BIA workshops, consolidate results, challenge assumptions and translate outcomes into recovery strategies and IT DR requirements.
Next step: see our Business Continuity Management services.
Frequently asked questions
How often should a BIA be updated?
At least annually and after significant changes to products, processes, systems or structure.
Who should participate?
Process owners from each business unit, with IT, risk and senior leadership for validation.
Is a BIA required for ISO 22301?
Yes. The BIA is a core requirement of the standard.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
