# BIA workpaper

SecNet.Work · Business continuity and disaster recovery · 2026.10

Assess the service, time-dependent impact and dependencies together.

Blank organizational workpaper. Enter real contact, asset and data details only in a controlled organizational copy. This file is not evidence, organizational approval or an automated compliance decision.

- Separate impact evidence from assumptions; identify peak periods.
- Approve objectives with business and technical owners.

| Service / activity | Business owner and deputy | Impact time interval | Minimum capacity | Dependencies | Disruption tolerance | RTO / RPO and measurement boundary | Rationale / approval |
| --- | --- | --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |
|  |  |  |  |  |  |  |  |

## Approval and follow-up

| Version | Owner | Approval | Review |
| --- | --- | --- | --- |
|  |  |  |  |

## Official references

- [ISO 22301:2019 · BCMS; Amendment 1:2024](https://www.iso.org/standard/75106.html)
- [ISO/IEC 27031:2025 · ICT readiness](https://www.iso.org/standard/27031)
- [NIST SP 800-34 Rev. 1 · updated 11 November 2010](https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final)
- [NIST SP 800-184 · Cybersecurity Event Recovery](https://csrc.nist.gov/pubs/sp/800/184/final)
- [CISA CRR · Service Continuity resource guide](https://www.cisa.gov/sites/default/files/c3vp/crr_resources_guides/CRR_Resource_Guide-SC.pdf)