Business Impact Analysis
Stands forBIA
A mapping of what happens to the business when a system is unavailable: who is affected, how fast, and at what cost. The basis for non-technical ranking.
Also calledBIA · criticality assessment
A process that establishes, for each system, exactly what breaks when it is unavailable: which business processes stop, how quickly, and what that costs. The output is a criticality rating that lets people discuss systems in terms that are not technical.
For patching this supplies the half a severity score is missing. A high-scoring flaw on a peripheral system and a moderate one on a core system are not equally urgent, and only the business mapping can tell them apart.
It also defines the opposite direction: how expensive it is to take the system down in order to patch it. A system with a high outage cost gets fewer windows, so each one is worth more — and should carry as many patches as it can.