Business Impact Analysis Questionnaire
Gathers each critical service's business impact analysis with its business owner, process by process: busy periods, the least each process needs, and the harm over time that sets the service's maximum tolerable downtime.
Available soon
- Format
- Excel
- Size
- 78 KB
- Length
- 12 sheets
- Version
- 1.1
- Updated
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook is. Under RR-21, each critical service's business impact analysis (RR-03) is gathered with its business owner process by process: what each process does, when it is busiest, the least it needs to run (people, sites, equipment, systems, suppliers and records), and its harm on the impact areas at each time point. The service's rating at each time point is the worst of its processes' ratings. The answers are kept with the objectives matrix and reviewed with them (RR-05). The resilience coordinator gathers it with the service's business owner, who answers for it; the site or unit continuity leads and the technical recovery lead are consulted (RA-20). Use one workbook per critical service. The Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) stays the record of the service's maximum tolerable downtime (MTD) and its recovery time and recovery point objectives (RTO, RPO). This workbook gives it the harm over time and the MTD, and sets neither objective. |
| 2 | Before the workshop, fill the Service sheet: the service's ID and name as the objectives matrix has them, its business owner, who gathers the answers, who else takes part and the sites or units it runs from. Check the two settings: the Severe level is the top of your risk register's impact scale, and the analysis is reviewed with the objectives at least every [[12]] months (RR-05). |
| 3 | Open the workshop with the questions on the Service sheet: what the service delivers and to whom, which activities one piece of work passes through, when it is busiest, and where the work is done. Those activities are the service's processes. |
| 4 | On the Processes sheet, give each process a block, PR-01 onwards in the order the work flows, and answer its questions with the business owner and the people who run it. The guide at the top of the sheet says why each question is asked. |
| 5 | Rate the harm. For each time point ask: if this process had stopped for this long, starting at its busiest time, how bad would the harm be? Rate each impact area on the scale on the Service sheet and enter the worst level, from 1 (Minor) to 4 (Severe). Rate every time point, whatever the cause and however quickly the systems usually come back. Name the area that reaches that level first, and say why in the business's words. |
| 6 | Record the least the process needs to keep going at its reduced level: people, sites, equipment, the systems and suppliers it cannot run without, and its vital records. Give systems and suppliers by their IDs in the Resilience Dependency Register, separated by commas, or write None. |
| 7 | On the Resources and Dependencies sheet, list each dependency ID the processes name, with its name, kind and the services the register says it supports. The sheet shows which processes need each one, and whether the register links it to this service. Add what is missing to the register (RR-09). |
| 8 | Read each block's Check: it says OK when the block is complete. Then read the Impact Over Time sheet. The service's level at each time point is the worst of its processes' levels (RR-21), and its maximum tolerable downtime is the first time point at which that level reaches Severe (RR-03). If the service never reaches Severe, ask whether it is a critical service at all (RR-01). |
| 9 | Take the results to the objectives matrix with the business owner, as the Into the Objectives Matrix sheet lists them. The service's level at each time point and what drives the harm go on its Impact Analysis sheet, where the MTD calculates again and must match this one. The business owner then agrees a recovery time objective shorter than the MTD (MX-01), a recovery point objective, and a workaround that keeps the harm below Severe until the service returns (RR-04, RR-06). IT proposes what is achievable; the business owner decides what is needed (RR-02). |
| 10 | Keep this workbook with the objectives matrix. Review it with the objectives at least every [[12]] months, and after a significant incident, a recovery test that missed an objective, or a significant change to the service, its suppliers or its risks (RR-05). The Service sheet gives the next review date. |
| 11 | To start your own analysis, clear every yellow cell, the EXAMPLE markers included. The grey cells calculate and stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you plan and test business continuity and recovery from a disruption, including a destructive cyberattack. It is not legal advice, and following it is not a statement that you comply with NIS2, DORA, the GDPR, HIPAA, ISO 22301 or any other law, standard or set of criteria. Which continuity and recovery duties apply to you depends on your sector and the law that applies to you: confirm them with counsel, your auditor or your supervisor.
Why every time point matters. Classic disaster recovery assumes the systems you recover with can be trusted: fail over to the second site, restore last night's backup, and carry on. A destructive cyberattack breaks that assumption. Replication copies the damage to the second site, the attacker may have been inside for weeks before the encryption, and the sign-in directory and administrator accounts you would recover with may be the attacker's. Recovery then starts with the foundations, rebuilt from sources you can trust, and every system is checked before it goes back. So rate the harm out to 168 hours even where a failure is usually fixed within hours. The objectives matrix sets the MTD beside the time a recovery would take after an attack (MX-05), and a service that would be back after its MTD needs a different plan (RR-07).
What this workbook does not decide. It sets no recovery time or recovery point objective (RR-02, RR-04) and no recovery order (RR-08). During an incident, the crisis lead's rights are those in RR-17 and every other decision right is P09's.
Who the law binds. The NIS2 Implementing Regulation (EU) 2024/2690 binds only the providers its Article 1 names; other entities may use its Annex as good practice. DORA binds financial entities only. HIPAA binds covered entities and business associates only. The Framework References sheet says which text asks for what.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders; an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply. It is not a HIPAA covered entity or business associate. After INC-2026-014, its Head of Risk, who runs no system in scope, coordinated a resilience review from 14 Sep 2026 to 25 Sep 2026. On 17 Sep 2026 the Head of Risk gathered the analysis of warehouse dispatch with the Head of Logistics: 5 processes, the worst of which reach Severe at 24 hours. On 25 Sep 2026 the Head of Logistics agreed, in the objectives matrix, a recovery time objective of 8 hours and a recovery point objective of 4 hours. This workbook shows the analysis as gathered.
Adapting this template
• One workbook per critical service. Save a copy for each, named with the service ID, and keep the copies with the objectives matrix.
• Your own impact scale: the Severe level on the Service sheet is the top of your risk register's scale. If your scale has more or fewer levels, set that level and change the level cells' validation on the Processes sheet to match.
• Other time points: the seven time points are this pack's default under RR-03. If your policy uses others, change the headers on the Processes and Impact Over Time sheets and the first-time formulas with them. A service that cannot tolerate 4 hours, such as payments, trading or a clinical service, needs earlier points: add them ahead of the 4-hour point, choosing them so the first is shorter than the service's real tolerance. The points are an agreed choice, so set them with the business owner.
• Small organisation: three to five processes and a one-hour workshop with the business owner are usually enough. Keep the questions on people and suppliers: a small team often depends on one person or one supplier.
• Several sites doing the same work: record the process once if the sites can stand in for one another, and say so under sites. Record it once for each site where only one site can do it, for example because only that site holds the equipment.
• IT run by a service provider: give the provider's systems the IDs the dependency register gives them, and record the provider itself under suppliers.
• More than eight processes: group small activities that always stop together, or split the service in two and analyse each part.
• Regulated entity: for the providers its Article 1 names, the NIS2 Implementing Regulation asks for a business impact analysis of severe disruptions and for continuity requirements set from it (Annex point 4.1.3). DORA Article 11(5) asks a financial entity's analysis to consider the criticality of business functions, support processes, third-party dependencies and information assets. A HIPAA covered entity or business associate assesses the relative criticality of its applications and data, an addressable specification (§ 164.308(a)(7)(ii)(E)): under each process, name the systems that hold electronic protected health information. Confirm with counsel what your regulator expects of the analysis.
This workbook is your own record. Keep it with the objectives matrix and the recovery plans, and keep a copy that can be reached when the main systems are down (RR-16).
Service
The service and its owner
One workbook per critical service. Yellow cells are yours; grey cells are fixed or calculated.
EXAMPLE: warehouse dispatch, gathered on 17 Sep 2026. Clear the yellow cells to start your own.
The service
| Question | Answer | Rule |
|---|---|---|
| Service ID, as in the objectives matrix | CS-02 | RR-01 |
| Critical service | Warehouse dispatch | RR-01 |
| Business owner: gives the answers and answers for them | Head of Logistics | RR-02, RA-20 |
| Gathered by: the resilience coordinator | Head of Risk | RA-20 |
| Also taking part: the site or unit continuity leads and the technical recovery lead, who are consulted | [[the site or unit continuity leads and the technical recovery lead who took part]] | RA-20 |
| Date gathered | 17 Sep 2026 | RR-21 |
| What the service delivers, and to whom | [[One sentence: what the service delivers, and to whom]] | RR-01 |
| Sites and business units it runs from | Warehouse 1 (SU-01), Warehouse 2 (SU-02), Warehouse 3 (SU-03) | RR-22 |
| Objectives last agreed in the objectives matrix | 25 Sep 2026 | RR-05 |
| Next review due, with the objectives (calc) | 25 Sep 2027 | RR-05 |
| Processes answered in full (calc) | 5 of 5 | RR-21 |
Questions to open the workshop
| Ask the business owner | Why |
|---|---|
| What does the service deliver, and to whom? What is the first thing a customer notices when it stops? | Sets the service's start and end, so the list of processes covers all of it. |
| Walk through one piece of work from start to finish, such as one order. Which activities does it pass through? | The processes. Three to eight is usual; an activity that stops whenever another stops belongs with it. |
| When in the year, the week and the day is the service at its busiest? | The outage to rate is one that begins then. |
| Which sites and teams do the work? Could one stand in for another? | The sites and units whose continuity plans carry the service (RR-22). |
| What has changed since the last analysis: a new site, a new system, a new supplier, a team that left? | Changes the last review may have missed (RR-05). |
Settings
| Setting | Value | Rule |
|---|---|---|
| The level on your risk register's impact scale that sets the MTD: the top of your own scale (Severe, level 4, in the pack's default scale below). | 4 | RR-03 |
| Months between the business owner's reviews of the analysis, with the objectives. | 12 | RR-05 |
| The time points, in hours, at which each process is rated: this pack's default under RR-03. To change them, see Adapting this template on the Instructions sheet. | 4, 8, 24, 48, 72, 120, 168 | RR-03 |
The impact scale (the risk register's, P02 and P05)
| Level | What it means |
|---|---|
| 1 Minor | Affects one system of Standard criticality or non-sensitive data; no customer or regulatory effect. |
| 2 Moderate | Affects a High criticality system or internal confidential data; limited, recoverable disruption. |
| 3 Major | Affects a Critical system, personal or customer data, or a regulated service; notifiable if it went wrong. |
| 4 Severe | Could stop a core business service, expose sensitive data at scale, or breach a legal obligation. |
The impact areas, and what Severe and Minor mean in each (P05)
| Area | What the scale's ends mean in this area |
|---|---|
| Financial | Severe: more than [[€1,000,000]]. Minor: less than [[€50,000]]. |
| Service | Severe: a core customer service stopped for more than [[2]] days. Minor: an internal service degraded for hours. |
| Data | Severe: personal or customer data at scale. Minor: internal, non-personal data. |
| Legal and regulatory | Severe: a notifiable breach, enforcement or contract termination. Minor: no notification or breach. |
| Reputation | Severe: national press, or loss of a major customer. Minor: not noticed outside the team. |
Rate each area at each time point; enter the worst level on the Processes sheet. The levels between the two ends follow the scale above.
Processes
Processes: one block per process
Answer each block with the business owner and the people who run the process. Yellow cells are yours; the last two rows of each block calculate.
Levels: 1 Minor, 2 Moderate, 3 Major, 4 Severe. A level at or above Severe shows in bold red, with its number.
The questions, and why each is asked
| Row in each block | Ask | Why it is asked | ||||||
|---|---|---|---|---|---|---|---|---|
| Process ID | Where does it come in the flow of work? | Number the processes PR-01, PR-02 and so on, in the order the work flows. The ID keeps each process's answers together across the sheets. | ||||||
| Process | What do the people who do the work call it? | Their own name for it, such as picking or goods receiving, so everyone recognises it. | ||||||
| What it does, and for whom | What does it do, and for whom? | Fixes where the process starts and ends, so that nothing falls between two processes. | ||||||
| When it is busiest | When is it busiest: which months, days or shifts? | Rate the harm as if the outage began at that time. The return to the normal set-up after a failover avoids these periods (RR-25), and they help choose the quiet period for a test or trial (RR-26). | ||||||
| Worst level, 1 to 4, if it stops for this long | If it stopped at its busiest time, how bad would the harm be after each time point? (4, 8, 24, 48, 72, 120, 168 hours) | Rate each impact area on the Service sheet's scale and enter the worst. Ask what happens once the process has stopped for that long. Leave out how long the systems usually take to come back. The harm can stay level but never falls as an outage goes on (RR-03). | ||||||
| Impact area that drives the harm | Which impact area reaches that level first? | The area of the risk register that drives the harm: Financial, Service, Data, Legal and regulatory or Reputation. | ||||||
| What happens, in the business's words | What actually happens? | The reason behind the ratings, such as customers running out of stock. The objectives matrix carries it beside the levels. | ||||||
| Least it needs: people | How many people, with which skills, keep it going at the least? | The people the process needs at its reduced level. Where only one person knows how, say so: that is a single point of failure (RR-09). | ||||||
| Least it needs: sites | Where can the work be done? Could another site take it? | Each site's or unit's continuity plan starts from this (RR-22). | ||||||
| Least it needs: equipment | What equipment does it need, and what would stand in for it? | Machines, devices and tools, with their stand-ins, such as handwritten labels for a label printer. | ||||||
| Systems it needs (register IDs) | Which systems can it not run without? | Give their IDs from the dependency register, separated by commas, or None. A system not yet in the register gets its ID there first (RR-09). | ||||||
| Suppliers it needs (register IDs) | Which outside companies can it not run without? | Give their IDs from the dependency register, or None. A supplier that runs a system the service needs also needs a recovery time in its contract (RR-10). | ||||||
| Vital records it needs | Which records would let it keep going with the systems down, and where are they? | Records on paper or in another system, such as the next day's pick lists. They must be reachable in an outage (RR-22). | ||||||
| Process 1 | PR-01 Picking | EXAMPLE | ||||||
|---|---|---|---|---|---|---|---|---|
| Process ID | PR-01 | |||||||
| Process | Picking | |||||||
| What it does, and for whom | Pickers collect each order's lines from the shelves, from the warehouse management system's pick lists | |||||||
| When it is busiest | November and December; the early shift on weekdays | |||||||
| Time since it stopped | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours | |
| Worst level, 1 to 4, if it stops for this long | 2 | 3 | 4 | 4 | 4 | 4 | 4 | |
| Impact area that drives the harm | Service | |||||||
| What happens, in the business's words | Customers' kitchens run out of perishable stock within a day | |||||||
| Least it needs: people | [[12]] pickers a shift across the working warehouses | |||||||
| Least it needs: sites | Any of the three warehouses | |||||||
| Least it needs: equipment | Hand-held scanners, or the printed pick lists | |||||||
| Systems it needs (register IDs) | DP-07 | |||||||
| Suppliers it needs (register IDs) | DP-08 | |||||||
| Vital records it needs | The next day's pick lists, printed each evening | |||||||
| First time at Severe, in hours (calc) | 24 | |||||||
| Check (calc) | OK | |||||||
| Process 2 | PR-02 Packing and labelling | EXAMPLE | ||||||
|---|---|---|---|---|---|---|---|---|
| Process ID | PR-02 | |||||||
| Process | Packing and labelling | |||||||
| What it does, and for whom | Orders are packed, checked and labelled for the carrier | |||||||
| When it is busiest | As picking | |||||||
| Time since it stopped | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours | |
| Worst level, 1 to 4, if it stops for this long | 1 | 2 | 3 | 4 | 4 | 4 | 4 | |
| Impact area that drives the harm | Service | |||||||
| What happens, in the business's words | Orders packed late miss the carriers' collection | |||||||
| Least it needs: people | [[6]] packers a shift | |||||||
| Least it needs: sites | The packing benches of any warehouse | |||||||
| Least it needs: equipment | Label printers, or handwritten labels | |||||||
| Systems it needs (register IDs) | DP-07 | |||||||
| Suppliers it needs (register IDs) | None | |||||||
| Vital records it needs | Pre-printed delivery note pads | |||||||
| First time at Severe, in hours (calc) | 48 | |||||||
| Check (calc) | OK | |||||||
| Process 3 | PR-03 Loading and carrier hand-over | EXAMPLE | ||||||
|---|---|---|---|---|---|---|---|---|
| Process ID | PR-03 | |||||||
| Process | Loading and carrier hand-over | |||||||
| What it does, and for whom | Packed orders are loaded and handed to the carriers with their manifests | |||||||
| When it is busiest | The afternoon collections | |||||||
| Time since it stopped | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours | |
| Worst level, 1 to 4, if it stops for this long | 2 | 3 | 4 | 4 | 4 | 4 | 4 | |
| Impact area that drives the harm | Service | |||||||
| What happens, in the business's words | A missed collection is a missed delivery day for every order on it | |||||||
| Least it needs: people | [[2]] loaders and a supervisor a shift | |||||||
| Least it needs: sites | The loading bays of any warehouse | |||||||
| Least it needs: equipment | Forklifts and pallet trucks | |||||||
| Systems it needs (register IDs) | DP-07, DP-11 | |||||||
| Suppliers it needs (register IDs) | DP-12 | |||||||
| Vital records it needs | Carrier manifests on paper forms | |||||||
| First time at Severe, in hours (calc) | 24 | |||||||
| Check (calc) | OK | |||||||
| Process 4 | PR-04 Goods receiving | EXAMPLE | ||||||
|---|---|---|---|---|---|---|---|---|
| Process ID | PR-04 | |||||||
| Process | Goods receiving | |||||||
| What it does, and for whom | Deliveries from suppliers are checked in and put away | |||||||
| When it is busiest | Monday and Thursday mornings | |||||||
| Time since it stopped | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours | |
| Worst level, 1 to 4, if it stops for this long | 1 | 1 | 2 | 3 | 3 | 4 | 4 | |
| Impact area that drives the harm | Financial | |||||||
| What happens, in the business's words | Stock not put away cannot be sold, and perishable deliveries spoil | |||||||
| Least it needs: people | [[3]] a shift | |||||||
| Least it needs: sites | The goods-in bay of any warehouse | |||||||
| Least it needs: equipment | Pallet trucks | |||||||
| Systems it needs (register IDs) | DP-07, DP-09 | |||||||
| Suppliers it needs (register IDs) | None | |||||||
| Vital records it needs | Copies of the open purchase orders | |||||||
| First time at Severe, in hours (calc) | 120 | |||||||
| Check (calc) | OK | |||||||
| Process 5 | PR-05 Returns | EXAMPLE | ||||||
|---|---|---|---|---|---|---|---|---|
| Process ID | PR-05 | |||||||
| Process | Returns | |||||||
| What it does, and for whom | Returned goods are checked, credited, and restocked or written off | |||||||
| When it is busiest | January | |||||||
| Time since it stopped | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours | |
| Worst level, 1 to 4, if it stops for this long | 1 | 1 | 1 | 2 | 2 | 3 | 3 | |
| Impact area that drives the harm | Financial | |||||||
| What happens, in the business's words | Credits can wait a few days; after a week customers notice | |||||||
| Least it needs: people | [[1]] a shift | |||||||
| Least it needs: sites | Any warehouse | |||||||
| Least it needs: equipment | None beyond the bench | |||||||
| Systems it needs (register IDs) | DP-09 | |||||||
| Suppliers it needs (register IDs) | None | |||||||
| Vital records it needs | Returns forms | |||||||
| First time at Severe, in hours (calc) | Not Severe by the last time point | |||||||
| Check (calc) | OK | |||||||
| Process 6 | Not used | ||||||
|---|---|---|---|---|---|---|---|
Process ID
Process
What it does, and for whom
When it is busiest
| Time since it stopped | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours |
Worst level, 1 to 4, if it stops for this long
Impact area that drives the harm
What happens, in the business's words
Least it needs: people
Least it needs: sites
Least it needs: equipment
Systems it needs (register IDs)
Suppliers it needs (register IDs)
Vital records it needs
First time at Severe, in hours (calc)
Check (calc)
| Process 7 | Not used | ||||||
|---|---|---|---|---|---|---|---|
Process ID
Process
What it does, and for whom
When it is busiest
| Time since it stopped | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours |
Worst level, 1 to 4, if it stops for this long
Impact area that drives the harm
What happens, in the business's words
Least it needs: people
Least it needs: sites
Least it needs: equipment
Systems it needs (register IDs)
Suppliers it needs (register IDs)
Vital records it needs
First time at Severe, in hours (calc)
Check (calc)
| Process 8 | Not used | ||||||
|---|---|---|---|---|---|---|---|
Process ID
Process
What it does, and for whom
When it is busiest
| Time since it stopped | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours |
Worst level, 1 to 4, if it stops for this long
Impact area that drives the harm
What happens, in the business's words
Least it needs: people
Least it needs: sites
Least it needs: equipment
Systems it needs (register IDs)
Suppliers it needs (register IDs)
Vital records it needs
First time at Severe, in hours (calc)
Check (calc)
Impact Over Time
Impact over time
Each process's level at each time point, from the Processes sheet, and the service's level: the worst of its processes' (RR-21). The MTD is the first time point at which the service reaches Severe (RR-03). Nothing here is typed.
Levels: 1 Minor, 2 Moderate, 3 Major, 4 Severe. A level at or above Severe shows in bold red, with its number.
| Process ID | Process | 4 hours | 8 hours | 24 hours | 48 hours | 72 hours | 120 hours | 168 hours | First time at Severe, hours | What drives the harm: the impact area, and why | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|
| PR-01 | Picking | 2 | 3 | 4 | 4 | 4 | 4 | 4 | 24 | Service: customers' kitchens run out of perishable stock within a day | OK |
| PR-02 | Packing and labelling | 1 | 2 | 3 | 4 | 4 | 4 | 4 | 48 | Service: orders packed late miss the carriers' collection | OK |
| PR-03 | Loading and carrier hand-over | 2 | 3 | 4 | 4 | 4 | 4 | 4 | 24 | Service: a missed collection is a missed delivery day for every order on it | OK |
| PR-04 | Goods receiving | 1 | 1 | 2 | 3 | 3 | 4 | 4 | 120 | Financial: stock not put away cannot be sold, and perishable deliveries spoil | OK |
| PR-05 | Returns | 1 | 1 | 1 | 2 | 2 | 3 | 3 | Not Severe by the last time point | Financial: credits can wait a few days; after a week customers notice | OK |
| Service | Worst of its processes (RR-21) | 2 | 3 | 4 | 4 | 4 | 4 | 4 | 24 | The MTD: the first time point at which the service reaches Severe (RR-03) | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| First to reach Severe | PR-01 Picking, PR-03 Loading and carrier hand-over | ||||||||||
| What drives the harm, and the area that reaches Severe first | Service: customers' kitchens run out of perishable stock within a day | ||||||||||
| Processes answered in full | 5 of 5 | ||||||||||
A process that never reaches Severe still counts: it can raise the service's level at a time point before the MTD. The service's level never falls, because each process's level never falls (RR-03).
Resources and Dependencies
Resources and dependencies
The least each process needs to keep going at its reduced level, from the Processes sheet, and the dependencies the processes name, checked against the Resilience Dependency Register.
The least each process needs to run, and its vital records
| Process ID | Process | People | Sites | Equipment | Systems (dependency IDs) | Suppliers (dependency IDs) | Vital records |
|---|---|---|---|---|---|---|---|
| PR-01 | Picking | [[12]] pickers a shift across the working warehouses | Any of the three warehouses | Hand-held scanners, or the printed pick lists | DP-07 | DP-08 | The next day's pick lists, printed each evening |
| PR-02 | Packing and labelling | [[6]] packers a shift | The packing benches of any warehouse | Label printers, or handwritten labels | DP-07 | None | Pre-printed delivery note pads |
| PR-03 | Loading and carrier hand-over | [[2]] loaders and a supervisor a shift | The loading bays of any warehouse | Forklifts and pallet trucks | DP-07, DP-11 | DP-12 | Carrier manifests on paper forms |
| PR-04 | Goods receiving | [[3]] a shift | The goods-in bay of any warehouse | Pallet trucks | DP-07, DP-09 | None | Copies of the open purchase orders |
| PR-05 | Returns | [[1]] a shift | Any warehouse | None beyond the bench | DP-09 | None | Returns forms |
The dependencies the processes name
Copy each dependency's name, kind and services from the Resilience Dependency Register; give a new one its ID there first (RR-09). The last two columns calculate.
| Row | Dependency ID | Name, as in the register | Kind | Services it supports in the register (IDs) | Named by these processes (calc) | Linked to this service in the register? (calc) |
|---|---|---|---|---|---|---|
| EXAMPLE | DP-07 | Warehouse management system | System | CS-02 | PR-01, PR-02, PR-03, PR-04 | Yes |
| EXAMPLE | DP-08 | Warehouse management system provider | Supplier | CS-02 | PR-01 | Yes |
| EXAMPLE | DP-09 | ERP software provider (hosted) | Supplier | CS-02, CS-04 | PR-04, PR-05 | Yes |
| EXAMPLE | DP-11 | Network connectivity provider | Supplier | CS-01, CS-02 | PR-03 | Yes |
| EXAMPLE | DP-12 | National parcel carrier, express courier, pallet network | Supplier | CS-02 | PR-03 | Yes |
A dependency the register gives this service that no process names may be one the business never sees, such as the foundations or a data set: keep it. Otherwise ask the business owner whether it is still needed.
Into the Objectives Matrix
Into the objectives matrix
What the business owner carries into the Critical Service Recovery Objectives Matrix (RTO, RPO, MTD), which stays the record of the service's maximum tolerable downtime and its recovery objectives. This workbook sets no recovery objective: the business owner agrees them there (RR-02, RR-04).
For the matrix's Impact Analysis sheet
| Column in the matrix | From this analysis (calc) | Where it comes from |
|---|---|---|
| Service ID | CS-02 | The Service sheet |
| Critical service | Warehouse dispatch | The Service sheet |
| Worst level at 4 hours | 2 | The service row of the Impact Over Time sheet (RR-21) |
| Worst level at 8 hours | 3 | The service row of the Impact Over Time sheet (RR-21) |
| Worst level at 24 hours | 4 | The service row of the Impact Over Time sheet (RR-21) |
| Worst level at 48 hours | 4 | The service row of the Impact Over Time sheet (RR-21) |
| Worst level at 72 hours | 4 | The service row of the Impact Over Time sheet (RR-21) |
| Worst level at 120 hours | 4 | The service row of the Impact Over Time sheet (RR-21) |
| Worst level at 168 hours | 4 | The service row of the Impact Over Time sheet (RR-21) |
| What drives the harm, and the area that reaches Severe first | Service: customers' kitchens run out of perishable stock within a day | The first process to reach Severe, on the Impact Over Time sheet |
| MTD: first time at Severe, in hours (calc) | 24 | The matrix calculates it from the levels: check it shows the same (RR-03) |
For the matrix's Objectives sheet: the business owner agrees these there
| Column in the matrix | What to bring from this analysis | Rule |
|---|---|---|
| Business owner | Head of Logistics | RR-02 |
| RTO, hours | Shorter than the MTD: less than 24 hours (MX-01) | RR-04 |
| RPO, hours | The most data, measured in time, the service can lose. Ask what each process could key in again, or find from other sources, and how long that would take. | RR-04 |
| Workaround | How the service keeps going without its systems, holding the harm below Severe until it returns. It needs the people, sites, equipment and vital records the Resources and Dependencies sheet lists for each process. | RR-06 |
| Objectives last agreed on | The date the business owner agrees them. Enter it on this workbook's Service sheet too: the next review counts from it. | RR-05 |
The first check the matrix makes
| Check | Test | Rule |
|---|---|---|
| MX-01 Recovery time shorter than the maximum | The RTO is shorter than the MTD. | RR-04 |
| A recovery time equal to or longer than the MTD would let the harm reach Severe before the service is back. Where the systems cannot be back within the RTO, the workaround carries the gap (RR-06). | ||
Where else the answers go
| Document | What to take there | Rule |
|---|---|---|
| Resilience Dependency Register | Every dependency ID the processes name, linked to this service. Add a dependency the register lacks, or this service to a dependency's row, as the Resources and Dependencies sheet shows. | RR-09 |
| Site & Business Unit Continuity Plan Template | For each site or unit the service runs from: the least each process needs there, and its vital records with where they are kept. | RR-22 |
| Cyber Recovery Plan Template | The service's plan: its MTD in section PS-1 (the service and its objectives) and, in section PS-5 (the workaround), what each process needs to keep going without its systems. | RR-06, RR-16 |
| Continuity & Disaster Recovery Test Plan and Report | Each process's busiest periods: they help choose the quiet period for a test or a trial. | RR-26 |
| IT Disaster Recovery Procedure | The same busiest periods: the return to the normal set-up after a failover avoids them. | RR-25 |
EXAMPLE: on 25 Sep 2026 the Head of Logistics agreed, in the objectives matrix, a recovery time objective of 8 hours for warehouse dispatch, shorter than its 24-hour MTD, so MX-01 passes, and a recovery point objective of 4 hours. The workaround: dispatch from printed pick lists of the next day's orders, printed each evening, for up to [[24]] hours.
Lists
| ImpactArea | Kind |
|---|---|
| Financial | Foundations |
| Service | System |
| Data | Supplier |
| Legal and regulatory | Data |
| Reputation | People |
Site
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Critical service | A service the organisation delivers whose disruption beyond its maximum tolerable downtime would cause Severe harm on the risk register's impact scale (RR-01). It is a business service, such as online ordering, not a system. |
| Business owner | The manager accountable for a critical service. Sets and agrees its objectives, accepts its workaround, and confirms it works before it returns to users (RR-02). |
| Business impact analysis (BIA) | Business impact analysis: for each critical service, how the harm grows over time on the risk register's impact areas, and the point at which it becomes Severe (RR-03). |
| Process | One activity a critical service is made of, such as picking or loading for dispatch. The business impact analysis rates each process, and the service takes the worst rating at each time point (RR-21). |
| Maximum tolerable downtime (MTD) | Maximum tolerable downtime: the longest a critical service can be unavailable before the harm reaches Severe on the impact scale. Found by the business impact analysis (RR-03). |
| Recovery time objective (RTO) | Recovery time objective: the time within which the service must be back, counted from the decision to recover it. Always shorter than the MTD (RR-04). |
| Recovery point objective (RPO) | Recovery point objective: the most data, measured in time, the service can lose. The backup interval of every data set it needs must be no longer (RR-04, MX-03). |
| Minimum resources | The least people, space, equipment, systems, suppliers and records a process or site needs to keep a critical service running at its agreed reduced level (RR-21, RR-22). |
| Vital records | Records a process cannot run without, on paper or in a system, such as the next day's pick lists or the delivery note pads. Kept where they can be reached when the systems are down (RR-22). |
| Workaround | A way of running the service, or its most important part, without its systems for a set time, such as dispatch from printed pick lists. Owned and accepted by the business owner (RR-06). |
| Dependency | Anything a critical service needs to run: a system, a supplier, a data set, a group of people, a site, or the foundations (RR-09). |
| Foundations | What every other recovery needs first: the sign-in directory, the core network and firewalls, the backup platform, endpoint protection and monitoring, and the emergency administrator accounts. |
| Site or unit continuity plan | A site's or business unit's plan for keeping its part of the critical services running when it loses its building, a large part of its people, a supplier it relies on, or its systems (RR-22). |
| Time point | The hours since the process or service stopped at which the harm is rated: 4, 8, 24, 48, 72, 120, 168 (RR-03). |
| Impact level | A level on the risk register's impact scale, from 1 (Minor) to 4 (Severe) (P02, P05). Enter the worst of the impact areas at each time point. |
| Impact area | One of the risk register's areas of harm: Financial, Service, Data, Legal and regulatory, Reputation (P05). |
| Service level at a time point | The worst level of any of the service's processes at that time point (RR-21). |
| First time at Severe | For a process, the first time point at which its level reaches Severe. For the service, the same point is its MTD (RR-03). |
| Busiest period | The months, days or shifts in which a process handles the most work. The harm is rated for an outage that begins then. |
| Single point of failure | A dependency whose loss stops the process, with nothing else able to take its place (RR-09). |
| CS-nn, PR-nn, DP-nn, SU-nn | The IDs of a critical service, a process, a dependency and a site or unit. Use the service's and the dependencies' IDs from the Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) and the Resilience Dependency Register. |
| RR-nn, RA-nn, MX-nn | The rules of the Business Continuity & ICT Resilience Policy, the activities of the Crisis & Recovery Responsibility Matrix and the checks of the Critical Service Recovery Objectives Matrix (RTO, RPO, MTD). |
| (calc) | A cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, its analysis of warehouse dispatch gathered on 17 Sep 2026. Clear before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.30 — ICT readiness for business continuity | The whole workbook: the business impact analysis from which the objectives matrix sets each critical service's recovery objectives, which its ICT must be ready to meet |
| NIST CSF 2.0 | GV.OC-04 — “Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated” | Service, Processes and Impact Over Time sheets: what the critical service delivers and to whom, and how the harm to those who depend on it grows with each hour it is down |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management” | The whole workbook: the business impact analysis that business continuity and disaster recovery plans start from |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | The Implementing Regulation applies only to the providers its Article 1 names. For them, the Annex points below; other entities may use them as good practice |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.1.3 — “The relevant entities shall carry out a business impact analysis to assess the potential impact of severe disruptions to their business operations and shall, based on the results of the business impact analysis, establish continuity requirements for the network and information systems.” | Processes and Impact Over Time sheets: the impact of a severe disruption on each process and on the service, over time; Into the Objectives Matrix sheet: the continuity requirements set from it. For the providers Article 1 names (NIS2 IR 1) |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.2.4 — based on the risk assessment (point 2.1) and the business continuity plan, “sufficient availability of resources by at least partial redundancy” of network and information systems; assets, including facilities, equipment and supplies; personnel with the necessary responsibility, authority and competence; and appropriate communication channels | Processes and Resources and Dependencies sheets: the least facilities, equipment, people and systems each process needs, which show where redundancy is needed. For the providers Article 1 names (NIS2 IR 1) |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 4.2.5 — “Where appropriate, the relevant entities shall ensure that monitoring and adjustment of resources, including facilities, systems and personnel, is duly informed by backup and redundancy requirements.” | Resources and Dependencies sheet: the facilities, systems and people each process needs at the least, from which redundancy requirements are set. For the providers Article 1 names (NIS2 IR 1) |
| DORA — Regulation (EU) 2022/2554 | Article 3(22) — “critical or important function”: a function “the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities”, or whose discontinued, defective or failed performance would materially impair continuing compliance with the conditions and obligations of its authorisation or its other obligations under applicable financial services law | Service sheet, for financial entities: the analysis of one function, which helps show whether it is critical or important as DORA defines it |
| DORA — Regulation (EU) 2022/2554 | Article 11(5) — “As part of the overall business continuity policy, financial entities shall conduct a business impact analysis (BIA) of their exposures to severe business disruptions.” The BIA uses quantitative and qualitative criteria, internal and external data and scenario analysis; considers the criticality of business functions, support processes, third-party dependencies and information assets and their interdependencies; and ICT assets and services are designed and used in full alignment with it, in particular to ensure “the redundancy of all critical components” | The whole workbook, for financial entities: an analysis of one service's exposure to severe disruption, with the criticality of its processes and their third-party dependencies (Resources and Dependencies sheet) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 24(1) — the ICT business continuity policy (DORA Article 11(1)) includes a description of its objectives, “including the interrelation of ICT and overall business continuity, and considering the results of the business impact analysis (BIA)”, its scope including limitations and exclusions, the timeframe covered, and “the criteria to activate and deactivate ICT business continuity plans, ICT response and recovery plans, and crisis communications plans”; and provisions on governance, roles, responsibilities and escalation, alignment of ICT and overall business continuity plans, plans for severe business disruptions, testing and review, and crisis communication | Into the Objectives Matrix sheet, for financial entities: the results of the analysis, which the continuity policy's objectives take into account |
| GDPR — Regulation (EU) 2016/679 | Article 32(1)(b) — the security measures include, as appropriate, “the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services” | Impact Over Time sheet: how long the service, and the systems that process personal data for it, can be unavailable before the harm is Severe, which sets the availability and resilience they need |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.308(a)(7)(ii)(E) — applications and data criticality analysis (addressable): “Assess the relative criticality of specific applications and data in support of other contingency plan components.” | Impact Over Time and Resources and Dependencies sheets, for a covered entity or business associate: how critical each process is, and the systems and records it needs, from which the criticality of applications and data can be assessed |
| AICPA Trust Services Criteria | SOC 2 CC9.1, Risk Mitigation | Impact Over Time sheet: how the harm of a disruption to the service grows over time, which the business owner weighs in choosing its recovery objectives and its workaround |
| ISO 22301:2019 incl. Amd 1:2024 | Clause 8.2.2 — Business impact analysis (clause number and title only) | Processes and Impact Over Time sheets: an analysis by process of the harm over time, and the MTD it gives. Related by the clause title only |
| ISO 22301:2019 incl. Amd 1:2024 | Clause 8.3.4 — Resource requirements (clause number and title only) | Processes and Resources and Dependencies sheets: the least people, sites, equipment, systems, suppliers and records each process needs. Related by the clause title only |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; ISO 22301:2019 incl. Amd 1:2024 (clause numbers and titles only); NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774; Regulation (EU) 2016/679 (GDPR); 45 CFR Part 164 (HIPAA Security Rule, eCFR current to 6 October 2026); AICPA Trust Services Criteria (number and series title only)
ISO/IEC 27001 references name the clause or control this document relates to; ISO 22301 is named by clause number and title only, and its text is not reproduced. Neither says that meeting one meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
The NIS2 Implementing Regulation binds only the providers its Article 1 names. DORA binds financial entities only.
HIPAA binds covered entities and business associates that create, receive, maintain or transmit electronic protected health information; others may read it as a reference. An addressable specification is not optional: it is put in place where reasonable and appropriate, or the reason is documented and an equivalent measure used where one is (§ 164.306(d)(3)). Using this document is not a statement that you comply with the Security Rule.
Trust Services Criteria are named by number and series title only; their statements are not reproduced. A report on them is an independent auditor's opinion on your controls, and nothing in this document says that a criterion is met.