Skip to content

BIA in BCM – Configuration (Damage Scenarios & Time Horizons)🔗

In the BIA Configuration you define the house rules according to which all BIA assessments in BCM are carried out. The goal is to ensure that all processes are evaluated against the same standards.

You typically configure the following here:

  • Damage potentials (severity of impacts)
  • Time horizons (how long a failure is tolerable)
  • Damage scenarios (types of impacts, e.g. financial vs. legal)

Defining Damage Potentials🔗

Damage potentials are the levels used to describe the severity of a damage.

Typical levels:

  • Low
  • Medium
  • High
  • Very high

For each level you can specify, for example:

  • A verbal description (e.g. "internal disruption with no external impact"),
  • Examples (e.g. "Short-term interruption of internal reporting").

This qualification particularly helps ensure that different people arrive at comparable assessments.

Defining Time Horizons🔗

Time horizons describe how long a process may be disrupted before a certain damage level is reached.

Examples:

  • 2 hours
  • 4 hours
  • 8 hours
  • 24 hours
  • 3 days
  • 7 days

Steps:

  1. Open the BIA – Configuration tile.
  2. Create your time horizons or adjust existing values.
  3. Ensure that the chosen levels are professionally meaningful for your organisation (e.g. hour-based for IT services, day-based for some business processes).

You will use these time horizons later in the assessment to determine when each damage level is reached.

Defining Damage Scenarios🔗

Damage scenarios describe in which dimension a damage occurs. Common scenarios in BCM include, for example:

  • Financial impact
  • Legal / regulatory impact
  • Reputational damage
  • Impact on safety / health
  • Impact on contractual obligations

Steps:

  1. Create a name and a brief description for each scenario.
  2. Optionally, you can prioritise or group scenarios (e.g. "mandatory scenarios" vs. "optional scenarios").
  3. Verify that your scenarios align with reporting requirements (management, regulatory, certification).

In the BIA assessment, these scenarios are combined with time horizons and damage potentials.

Damage Development Visualisation🔗

Many BIA implementations graphically display how damage develops over time:

  • on the X-axis: Time horizons
  • on the Y-axis: Damage potentials

Your configuration produces typical curves per scenario, for example:

  • up to 2 hours: "low",
  • from 4 hours: "medium",
  • from 8 hours: "high",
  • from 24 hours: "very high".

You will use these defined progressions later in the assessment to classify processes.

Relationship to BIA Assessment🔗

The configuration forms the foundation for the BIA assessment:

  • The time horizons specify which points in time you need to consider during the assessment.
  • The damage potentials define the scale on which you assess.
  • The damage scenarios determine which types of impacts need to be examined per process.

If you change the configuration, you should verify whether existing assessments need to be updated (e.g. when new scenarios are added or time horizons are significantly altered).