Business Impact Analysis for Business

Continuity
Maximum Acceptable Outage (Definition): The Maximum Acceptable Outage
(MAO) is the maximum amount of time a system can be unavailable before
its loss will compromise the organization's objectives or survival.
Maximum Tolerable Downtime (Definition): The maximum length of time a
business function can be discontinued without causing irreparable harm to
the business.
Recovery Point Objective (RPO): A recovery point objective, or RPO, is
defined by business continuity planning. It is the maximum targeted period
in which data might be lost from an IT service due to a major incident.
Recovery Time Objective: The recovery time objective (RTO) is the targeted
duration of time and a service level within which a business process must be
restored after a disaster (or disruption) in order to avoid unacceptable
consequences associated with a break in business continuity.
Mean Time Between Failure :(MTF/MTBF): Mean time between failures (MTBF)
is the predicted elapsed time between inherent failures of a system during
operation.[1] MTBF can be calculated as the arithmetic mean (average) time
between failures of a system.
Mean Time to Repair/Recover (MTR/MTTR): Mean Time To Repair (MTTR) is a
basic measure of the maintainability of repairable items. It represents the
average time required to repair a failed component or device.[1] Expressed
mathematically, it is the total corrective maintenance time divided by the
total number of corrective maintenance actions during a given period of
time.
Consider the following scenario.
Stage 1: Business as usual

At this stage all systems are running production and working correctly.
Stage 2: Disaster occurs

On a given point in time, disaster occurs and systems need to be recovered. At this point the
Recovery Point Objective (RPO) determines the maximum acceptable amount of data loss
measured in time. For example, the maximum tolerable data loss is 15 minutes.
Stage 3: Recovery

At this stage the system is recovered and back online but not ready for production yet. The
Recovery Time Objective (RTO) determines the maximum tolerable amount of time needed to
bring all critical systems back online. This covers, for example, restore data from back-up or fix

of a failure. In most cases this part is carried out by system administrator, network administrator,
storage administrator etc.
Stage 4: Resume Production

At this stage all systems are recovered, integrity of the system or data is verified and all critical
systems can resume normal operations. The Work Recovery Time (WRT) determines the
maximum tolerable amount of time that is needed to verify the system and/or data integrity. This
could be, for example, checking the databases and logs, making sure the applications or services
are running and are available. In most cases those tasks are performed by application
administrator, database administrator etc. When all systems affected by the disaster are verified
and/or recovered, the environment is ready to resume the production again.

The sum of RTO and WRT is defined as the Maximum Tolerable Downtime (MTD) which
defines the total amount of time that a business process can be disrupted without causing any
unacceptable consequences. This value should be defined by the business management team or
someone like CTO, CIO or IT manager.
This is of course a simple example of a Business Continuity/Disaster Recovery plan and should
be included in your Business Impact Analysis (BIA).