# Clause 8.2.2: Business impact analysis

Use the impact analysis to set continuity priorities and requirements: settle which types of impact matter in the organization's context and the criteria for judging them; identify the activities that support delivery of products and services; assess how the impact of disrupting those activities grows over time; fix the point beyond which failing to resume would be unacceptable; within that point, set prioritized time frames for resuming the activities at a stated minimum capacity that is still acceptable; identify the prioritized activities; and establish the resources, dependencies and interdependencies they need, partners and suppliers included.

Cloud: The impact analysis should state, for each critical activity, how long it can stop and what it would cost, then compare that with the provider's recovery commitment. Where the commitment is longer than the tolerance, you have a gap whether or not the contract is compliant.

Evidence: Defined impact types and criteria approved for this organization; Activity inventory mapped to products and services; Impact over time analysis per activity; Maximum tolerable period of disruption and resumption time frames with minimum acceptable capacity, approved by management; Prioritized activity list with resource, dependency and interdependency mapping.

Test: Put the provider recovery commitment beside the activity's tolerance and mark the gap.

Citation: ISO 22301:2019, clause 8.2.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.