# Clause 8.2: Business impact analysis and risk assessment

Run and maintain the processes that establish what disruption would cost the organization over time and what could cause it, and refresh both whenever the organization or its operating context changes significantly.

Cloud: The analysis has to treat a provider outage as a scenario in its own right, alongside the loss of your own site. The two have different warning signs, different recovery paths and different evidence.

Evidence: Documented BIA and risk assessment processes; Current outputs of both; Review triggers and evidence of review after significant change.

Test: Confirm a provider outage scenario is analysed separately from a site loss.

Citation: ISO 22301:2019, clause 8.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.