You score twenty-five numbers per business service. Maximum tolerable downtime, recovery time and point objectives, the minimum continuity objective, the criticality band and the DORA Article 3(22) determination with its written rationale all derive themselves.
Recovery objectives, continuity plans, the resilience budget, the scope of testing and the determination of which functions are critical or important are all downstream of one question: how long can each thing this entity does be unavailable before the consequences stop being acceptable?
One row per service a client would notice stopping. Not systems, not departments.
Five impact categories at 1 hour, 4 hours, 24 hours, 72 hours and one week.
MTPD, RTO, RPO and the MBCO sentence are already filled in when you come back.
The Article 3(22) criteria, in plain English. The determination completes itself.
The CIF register and the third-party bridge are laid out for the Register of Information.
| Tab | What it does |
|---|---|
| Cover | Engagement details, the eight-step method, the severity scale and a plain-language glossary of MTPD, RTO, RPO and MBCO. |
| Setup | The two judgement calls a BIA cannot avoid, defaulted to defensible values and reproduced verbatim in every rationale the workbook writes. |
| Interview guide | Twenty-four workshop questions, what a good answer sounds like, which column it fills and the trap it exists to prevent. Plus the severity anchors. |
| BIA functions | Sixty business services. Only the coloured cells are yours; twenty derived columns do the rest. |
| Impact over time | Five categories by five durations. The only thing you actually score. |
| Dependencies | Four hundred links: people, ICT systems, facilities, third-party providers, information and equipment. |
| CIF register | Fills itself, in the field order of RT.04.01 of the Register of Information. |
| Third-party bridge | Every provider supporting a critical function, with substitutability and a concentration count. |
| Dashboard | Four KPIs, two charts and two narrative lines written for the board pack. |
| Data quality | Fourteen checks. The gate between a working file and a report. |
| Method & mapping | ISO/TS 22317 process step, what the workbook does, the DORA article, the downstream artefact. |
Secure payment by Stripe. VAT invoice issued automatically; EU businesses entering a VAT number get the reverse-charge invoice.
A client will ask you how you arrived at a four-hour recovery objective. This is the chain, and it is the same one every time, which is what makes the answer defensible.
The business impact analysis produces the inputs. The critical-or-important function determination and the Register of Information consume them. Doing them in the wrong order is why most registers cannot be defended.
Service catalogue, impact over time, recovery objectives, dependencies. This page.
You are hereThe Article 3(22) determination, the T1/T2/T3 model and the materiality threshold, explained in full.
Read the CIF methodology →The supervisory submission under ITS 2024/2956, populated from the functions and providers you just mapped.
See the Register of Information →Clause 8.2.2 asks for exactly this analysis. Our ISO 22301 documentation toolkit ships the procedure that governs it and names this workbook as the evidence, so the two fit together rather than overlapping.
See the ISO 22301 Toolkit →No, and nothing can be. ISO/TS 22317:2021 is a Technical Specification providing guidelines for business impact analysis, not a requirements standard, so no organisation, product or deliverable is certifiable against it. What a practitioner can do is follow its process, which is what this workbook implements. We say structured on, and we mean it literally.
No. Article 3(22) is drafted in terms of the materiality of impact, not in hours. Each entity must define, justify and document its own threshold. The workbook defaults to 72 hours, explains why that is defensible, and writes whatever you set into every rationale so the choice is documented rather than implied.
That is who it is built for. The interview guide gives you the questions to ask and the answers to listen for, the severity anchors stop the scoring being arbitrary, the criticality band is computed so it cannot be inflated, and fourteen data-quality checks catch the mistakes that get a BIA rejected on review before a client ever sees it.
Yes. It is a consultant instrument and there is no per-engagement licence. Save a copy per client.
Neither. There are no macros, and the formulas deliberately avoid dynamic arrays, so it behaves identically in LibreOffice Calc and in older versions of Excel.
Immediately after payment you land on a page with both files. The same link is emailed to you and keeps working, so you can download again on any device.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.