Resilience

Business Continuity

Impact analysis, recovery targets, and operational resilience

Business Continuity in Acuna goes beyond a static BCP document. It connects process criticality scoring, recovery targets, dependency mapping, impact scenarios, and asset relationships in one operational view, so resilience committees, auditors, and operations all work from the same data. Whether you are implementing ISO 22301, meeting DORA operational resilience requirements, or running your own internal continuity programme, the module gives you a structured, auditable foundation.

Interactive demo

See how it works.

Capabilities

What Business Continuity does.

Business Impact Analysis (BIA) with Criticality Scoring

Run a structured BIA across your process inventory. Score each process on criticality using configurable dimensions: financial impact, regulatory impact, reputational impact, and operational dependency. Acuna calculates a composite criticality score that drives prioritisation for RTO/RPO assignment and resource allocation. Results feed directly into management dashboards so committees see a data-driven priority list, not department lobbying.

RTO / RPO / MTPD per Process

Record Recovery Time Objective (RTO), Recovery Point Objective (RPO), and Maximum Tolerable Period of Disruption (MTPD) for every process. Each target is linked to the owning business unit and responsible individual. Targets surface in resilience reports and are compared against actual recovery capabilities during exercises. When a target is missed in a test, the gap is visible to auditors without manual reconciliation.

Impact Scenarios and What-If Analysis

Define impact scenarios: loss of premises, IT outage, key supplier failure, cyber incident, pandemic, and map them to affected processes. Each scenario shows which critical processes would be disrupted, what the cascading impact looks like, and which recovery plans apply. This is the bridge between a theoretical BCP and a practical operational response.

Asset and Resource Dependencies

Link processes to the assets, systems, people, and suppliers they depend on. Acuna visualises dependency chains so you can identify single points of failure (SPOFs) before they cause outages. When a critical asset or supplier is flagged, every dependent process surfaces automatically, giving resilience teams and auditors a connected view instead of isolated spreadsheet tabs.

Recovery Strategy and Plan Management

Structure recovery strategies and crisis playbooks alongside the same process inventory used for ISO 22301 or internal resilience testing. Each plan references its target processes, required resources, activation criteria, and responsible teams. Plans are versioned so you can show auditors the evolution from one review cycle to the next.

Exercise and Testing Lifecycle

Schedule and track continuity exercises: tabletop, walkthrough, simulation, or full failover. Record exercise objectives, participants, observations, and gaps. Link findings back to specific processes and recovery plans so follow-up actions close the loop. Exercise history provides the evidence trail ISO 22301 auditors look for.

Continuity Dashboards and Reporting

Purpose-built dashboards show BIA coverage, criticality distribution, RTO/RPO compliance, exercise completion rates, and open gaps. Export reports for resilience committees, board presentations, and regulatory submissions. The data comes from live process records, not a static slide deck updated once a year.

Cross-Module Integration

Business continuity data connects to the rest of Acuna: processes link to controls in Implement, risks in Enterprise Risk, suppliers in Supplier Shield, and evidence in Assure. A single process record is the source of truth across modules, no duplicate inventories, no reconciliation spreadsheets.

Related panes

implementoperateassure

FAQ

Common questions about Business Continuity.

How does BIA scoring work in Acuna?

Acuna scores each process across configurable impact dimensions: financial, regulatory, reputational, and operational. Each dimension is rated on a consistent scale, and a composite criticality score is calculated automatically. The score drives prioritisation: processes with the highest criticality get RTO/RPO targets first, and resilience committees see a ranked list instead of subjective department rankings.

Can I define different impact scenarios and see which processes are affected?

Yes. You create impact scenarios (e.g. data centre outage, key supplier failure, pandemic) and map them to processes. Acuna shows which critical processes each scenario would disrupt, the expected cascading impact, and which recovery plans apply, giving you a concrete view of your exposure for each threat type.

How do RTO, RPO, and MTPD relate to each other?

RTO defines how quickly a process must be restored, RPO defines how much data loss is acceptable, and MTPD defines the absolute maximum time a process can be unavailable before the impact becomes unacceptable. Acuna records all three per process and flags inconsistencies, for example, an RPO that exceeds the MTPD.

Does Acuna identify single points of failure?

Yes. By mapping processes to their asset, system, people, and supplier dependencies, Acuna highlights where a single dependency failure would take down one or more critical processes. SPOFs are flagged in the dependency view and can be linked to mitigation actions or risk treatment plans.

How do I track continuity exercises and their results?

Create exercise records with type (tabletop, walkthrough, simulation, full failover), objectives, participants, and scheduled dates. After the exercise, record observations, gaps, and follow-up actions. Findings link back to specific processes and recovery plans, and the exercise history provides the evidence trail auditors expect under ISO 22301.

Can I link continuity data to supplier dependencies in Supplier Shield?

Yes. Processes can be linked to suppliers, and when a supplier is flagged as critical or high-risk in Supplier Shield, every dependent process surfaces in the continuity view. This cross-module connection is how you show SPOFs that span both internal systems and critical third parties.

Does the module support ISO 22301 compliance?

The module is designed with ISO 22301 requirements in mind: structured BIA, documented recovery strategies, exercise tracking with evidence, and management review reporting. You can map your BCM programme to ISO 22301 clauses in Comply and use the evidence from Business Continuity to demonstrate conformance during certification audits.

How does business continuity data appear in management reports?

Dashboards show BIA coverage percentage, criticality score distribution, RTO/RPO target compliance, exercise completion rates, and open gap counts. Reports can be exported for resilience committees and board presentations. The data is live, it reflects the current state of your process inventory, not a snapshot from the last annual review.

Related answers

Questions practitioners ask.

What is DORA in financial services?

The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) applies to financial entities in the EU. It establishes requirements for ICT risk management, ICT-related incident reporting, digital operational resilience testing (including threat-led penetration testing for significant entities), ICT third-party risk management, and information sharing on cyber threats. DORA became applicable on 17 January 2025. Acuna covers DORA requirements across all four panes: framework mapping in Comply, ICT controls and asset inventory in Implement, incident and third-party management in Operate, and TLPT findings and corrective actions in Assure.

What is Business Impact Analysis (BIA) in Acuna?

Business Impact Analysis in Acuna scores each business process across configurable impact dimensions — financial, regulatory, reputational, and operational dependency. Each dimension is rated on a consistent scale, and a composite criticality score is calculated automatically. The score drives prioritisation: processes with the highest criticality get RTO/RPO/MTPD targets first, and resilience committees see a ranked priority list. BIA results feed into management dashboards, connect to recovery plans, and link to the asset and supplier dependencies that underpin each process.

What is the difference between RTO, RPO, and MTPD?

RTO (Recovery Time Objective) defines how quickly a process must be restored after a disruption. RPO (Recovery Point Objective) defines how much data loss is acceptable, measured in time. MTPD (Maximum Tolerable Period of Disruption) defines the absolute maximum time a process can be unavailable before the impact becomes unacceptable to the organisation. In Acuna, all three are recorded per process and linked to the owning business unit. The platform flags inconsistencies — for example, an RPO that exceeds the MTPD — and compares targets against actual recovery capabilities during exercises.

See Business Continuity in action.

Get access and our team will walk you through Business Continuity and the full Acuna platform.

Get a demo
Business Continuity and BIA | Acuna GRC Platform | Acuna