What is the purpose of a Business Impact Analysis?

• A. A formal assessment of financial impact in the event of a disaster.
• B. A plan for migrating to cloud services.
• C. A list of assets with criticality reflecting their importance to the organization.
• D. A schedule for employee training on security policies.

Answer: (C)

The purpose of a Business Impact Analysis is to identify which assets and processes are essential to the organization and to rank them by how critical they are to operations. It involves mapping business activities to the systems, data, facilities, and people they depend on, and assessing the potential consequences of disruptions for each asset or process. This establishes recovery priorities and tolerances, such as how quickly things must be restored (RTO) and how much data loss is acceptable (RPO), guiding where to focus resilience and recovery efforts. This focus on prioritizing assets by importance makes it the best fit, rather than plans for cloud migration or training schedules, or a narrow financial impact assessment.