Field Notes: BIA and the Disaster Recovery Plan — Not the Same Job
Contingency planning has distinct phases, much like the risk management process does. You start with high-level policy, move into action-oriented work, and end with a continuous improvement loop that feeds back into the top of the chain. NIST SP 800-34 Rev. 1 lays out that same shape for contingency planning: develop policy, conduct the Business Impact Analysis (BIA), identify preventative controls, build contingency strategies and plans, then test and improve.
Two pieces of that process are worth pulling apart, because people tend to lump them together: the BIA and the Disaster Recovery Plan (DRP).
The BIA Asks What Matters
The BIA helps an organization figure out which systems and components actually support its mission, and prioritize them based on business impact. It looks at critical processes, supporting systems, dependencies, resources, downtime impact, and recovery priority.
Why bother? Because not every system in a business deserves the same recovery priority. An internal project management server isn't as critical to restore after a disaster as a public-facing customer portal or a financial data system. The BIA is what establishes that hierarchy before the disaster hits, not during it. Get this right and you make recovery decisions driven by risk and business priority. Get it wrong, and you end up spending time and money protecting the wrong things while the stuff that actually matters sits exposed.
The DRP Asks How to Get It Back
The BIA and DRP phases put that analysis into action. NIST SP 800-34 Rev. 1 defines the DRP specifically as a plan focused on restoration from catastrophic events — and it applies to "major, usually physical disruptions to service that deny access to the primary facility infrastructure for an extended period."
Read that definition closely and it covers more than you'd first assume: natural disasters and fires, sure, but also things like terrorism, bomb threats, or an extended "stay home" order that keeps everyone out of the building for weeks. Anything that denies access to the primary site for a meaningful stretch of time falls under DRP territory.
When that happens, operations move to one of four kinds of alternate sites, in order of cost and recovery speed:
- Cold site — basic infrastructure, little to no equipment in place.
- Warm site — partially equipped, some hardware and systems ready.
- Hot site — fully equipped and configured for rapid recovery.
- Mirrored site — a redundant facility already mirroring operations in real time.
Each option trades cost against recovery speed, and the BIA is what should inform which one actually makes sense for a given organization — there's no point paying for a mirrored site to protect a system that barely matters.
Where They Overlap, Where They Don't
The BIA and DRP are both concerned with resilience — how an organization withstands disruption to critical systems and operations — and they're both part of the same larger contingency planning program. The difference is in the question each one answers: the BIA is analytical, asking what matters. The DRP is operational, asking how do we get it back.
The Takeaway
No organization can predict exactly what's coming. You can plan for the scenarios you can think of, and even then, there's always more you could be doing — a system you haven't prioritized correctly, a recovery site you haven't actually tested failing over to. The BIA and DRP aren't a one-time checkbox. They're the discipline of looking again, periodically, and asking whether you've actually covered what matters.
Sources
- National Institute of Standards and Technology. SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems.