DORA Business Impact Analysis Toolkit (Excel)

Rate the impact. The workbook writes the rest.

The analysis everything else depends on

Recovery objectives, continuity plans, the resilience budget, the scope of testing and the determination of which functions are critical or important are all downstream of one question: how long can each thing this entity does be unavailable before the consequences stop being acceptable?

List the services

One row per service a client would notice stopping. Not systems, not departments.

Rate impact over time

Five impact categories at 1 hour, 4 hours, 24 hours, 72 hours and one week.

Read the objectives

MTPD, RTO, RPO and the MBCO sentence are already filled in when you come back.

Answer three questions

The Article 3(22) criteria, in plain English. The determination completes itself.

Hand over the register

The function register is template B_06.01 of the Register of Information, ready to paste. The third-party bridge lists the providers behind each critical function.

Tab	What it does
Cover	Engagement details, the eight-step method, the severity scale and a plain-language glossary of MTPD, RTO, RPO and MBCO.
Setup	The two judgement calls a BIA cannot avoid, defaulted to defensible values and reproduced verbatim in every rationale the workbook writes.
Interview guide	Twenty-four workshop questions, what a good answer sounds like, which column it fills and the trap it exists to prevent. Plus the severity anchors.
BIA functions	Sixty business services. Only the coloured cells are yours; twenty derived columns do the rest.
Impact over time	Five categories by five durations. The only thing you actually score.
Dependencies	Four hundred links: people, ICT systems, facilities, third-party providers, information and equipment.
Function register (B_06.01)	Fills itself as template B_06.01 of the Register of Information (ITS 2024/2956): every function a third-party ICT service supports, in the column order of the ITS, ready to paste.
Third-party bridge	Every provider supporting a critical function, with substitutability and a concentration count.
Dashboard	Four KPIs, two charts and two narrative lines written for the board pack.
Data quality	Fourteen checks. The gate between a working file and a report.
Method & mapping	ISO/TS 22317 process step, what the workbook does, the DORA article, the downstream artefact.

€149 excl. VAT

Excel workbook, 11 tabs, 60 services and 400 dependency slots
Methodology guide (PDF) with the workshop script
Works in Excel and LibreOffice, no macros
Instant delivery, reusable on every engagement
Free updates

Get the BIA Toolkit

Secure payment by Stripe. VAT invoice issued automatically; EU businesses entering a VAT number get the reverse-charge invoice.

Where the numbers come from

A client will ask you how you arrived at a four-hour recovery objective. This is the chain, and it is the same one every time, which is what makes the answer defensible.

You rateFive impact categories at five durations, against written anchors.

Worst per durationThe highest severity across categories. Impact is never averaged.

MTPDThe last duration at which impact is still tolerable.

RTO and RPOThe next bucket below the MTPD, with headroom, and a data-loss tolerance in plain language.

CriticalityComputed, never typed. There is no cell in which to inflate it.

Article 3(22)The time test or any one of the three criteria, with the rationale written for you.

It is the first step of three

The business impact analysis produces the inputs. The critical-or-important function determination and the Register of Information consume them. Doing them in the wrong order is why most registers cannot be defended.

1. Business impact analysis

Service catalogue, impact over time, recovery objectives, dependencies. This page.

You are here

2. Critical or important functions

The Article 3(22) determination, the T1/T2/T3 model and the materiality threshold, explained in full.

Read the CIF methodology →

3. Register of Information

The supervisory submission under ITS 2024/2956, populated from the functions and providers you just mapped.

See the Register of Information →

Also certifying to ISO 22301?

Clause 8.2.2 asks for exactly this analysis. Our ISO 22301 documentation toolkit ships the procedure that governs it and names this workbook as the evidence, so the two fit together rather than overlapping.

See the ISO 22301 Toolkit →

When one of those services actually stops

The BIA tells you which services matter and how fast they must come back. It does not tell you who convenes, who decides, and who must be told within the hour. That is the crisis pack.

See Crisis Management →

Questions

Is this certified against ISO/TS 22317?

No, and nothing can be. ISO/TS 22317:2021 is a Technical Specification providing guidelines for business impact analysis, not a requirements standard, so no organisation, product or deliverable is certifiable against it. What a practitioner can do is follow its process, which is what this workbook implements. We say structured on, and we mean it literally.

Does DORA require a specific recovery time or materiality threshold?

No. Article 3(22) is drafted in terms of the materiality of impact, not in hours. Each entity must define, justify and document its own threshold. The workbook defaults to 72 hours, explains why that is defensible, and writes whatever you set into every rationale so the choice is documented rather than implied.

I have never run a business impact analysis. Is this usable?

That is who it is built for. The interview guide gives you the questions to ask and the answers to listen for, the severity anchors stop the scoring being arbitrary, the criticality band is computed so it cannot be inflated, and fourteen data-quality checks catch the mistakes that get a BIA rejected on review before a client ever sees it.

Can I use it on more than one client?

Yes. It is a consultant instrument and there is no per-engagement licence. Save a copy per client.

Does it need macros or a recent Excel?

Neither. There are no macros, and the formulas deliberately avoid dynamic arrays, so it behaves identically in LibreOffice Calc and in older versions of Excel.

How is it delivered?

Immediately after payment you land on a page with both files. The same link is emailed to you and keeps working, so you can download again on any device.

Practitioner tools for DORA compliance teams

Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.

academy-bundle

DORA Certifications Bundle

399 € excl. VAT

academy

DORA for IT & Security Teams

199 € excl. VAT