Business Impact Analysis

1. A hospital's electronic health records (EHR) system is offline for 6 hours due to a ransomware attack. Management states that the EHR system cannot be down for more than 4 hours without creating unacceptable risk to patient care. Which BIA metric has been violated, and what does it measure?

A. RPO has been violated; it measures how long the system can be offline before data loss becomes unacceptable B. RTO has been violated; the Recovery Time Objective defines the maximum acceptable downtime — the EHR was offline for 6 hours against a 4-hour RTO, meaning recovery took longer than the business can tolerate C. MTTR has been violated; mean time to repair exceeded the acceptable repair window D. MTBF has been violated; the system failed sooner than the expected interval between failures

2. A financial trading platform's Recovery Point Objective (RPO) is 15 minutes. The platform currently runs a nightly backup at 2 AM. A failure occurs at 3 PM, and recovery restores data from the 2 AM backup. What problem does this scenario reveal, and what must be changed?

A. The RTO is too short; the system needs more time to recover from failures B. The backup frequency violates the RPO; a 15-minute RPO requires backups every 15 minutes (or continuous replication), not once daily — the nightly backup means up to 13 hours of trading data could be lost, far exceeding the 15-minute acceptable data loss limit C. The MTBF is too low; the system is failing more often than expected based on backup frequency D. The MTTR exceeds the RPO; restoration time from backup is longer than 15 minutes

3. Over the past year, a web server experienced 4 outages with repair times of 3 hours, 5 hours, 2 hours, and 6 hours. What is the Mean Time to Repair (MTTR) for this server?

A. 6 hours; MTTR is the longest single repair time experienced B. 4 hours; MTTR = Total Repair Time (3+5+2+6 = 16 hours) divided by Number of Repairs (4) = 16 ÷ 4 = 4 hours average repair time C. 2.5 hours; MTTR is the median of the four repair times D. 16 hours; MTTR is the total accumulated repair time across all incidents

4. A database server ran for 8,736 hours (approximately one year) with 3 failures during that period. The total downtime across all three failures was 12 hours. What is the Mean Time Between Failures (MTBF) for this server?

A. 2,912 hours; MTBF = Total Hours / Number of Failures without adjusting for downtime B. 2,908 hours; MTBF = Total Uptime (8,736 − 12 = 8,724 hours) divided by Number of Breakdowns (3) = 8,724 ÷ 3 = 2,908 hours between failures on average C. 4 hours; MTBF measures average repair time, not time between failures D. 8,724 hours; MTBF is the total uptime excluding downtime without dividing by failure count

5. A company's BIA states that the payroll system has a 2-hour RTO. Over the last 12 months, the payroll system experienced 6 failures with an average repair time of 3.5 hours per failure. What conclusion should the security and operations teams draw from this data?

A. The system is performing well because MTBF indicates high reliability with only 6 failures per year B. The MTTR (3.5 hours) exceeds the RTO (2 hours), meaning every failure results in an RTO violation; recovery capabilities must be improved through automation, pre-positioned resources, or hot standby systems to close the 1.5-hour gap C. The RPO is at risk because 6 failures per year indicates data is being lost more often than the backup schedule compensates for D. The RTO should be increased to 4 hours to match actual MTTR performance, since MTTR represents real-world recovery capability

6. A BIA identifies the following for a customer-facing e-commerce platform: the business cannot tolerate more than 1 hour of downtime (otherwise customers move to competitors permanently), the business can accept losing at most 30 minutes of order data in any failure event, and over the past year the platform failed 3 times with repair times of 45 minutes, 50 minutes, and 55 minutes. Which BIA metrics align correctly with this scenario?

A. RTO = 30 minutes, RPO = 1 hour, MTTR = 50 minutes; MTTR exceeds RTO so recovery is adequate B. RTO = 1 hour (maximum acceptable downtime), RPO = 30 minutes (maximum acceptable data loss driving 30-minute backup intervals), MTTR = 50 minutes (150 minutes total / 3 failures); MTTR is within the RTO so current recovery performance meets the objective C. RTO = 1 hour, RPO = 30 minutes, MTBF = 50 minutes; MTBF measures recovery speed not reliability D. MTBF = 1 hour, MTTR = 30 minutes; RTO and RPO are calculated from MTBF and MTTR values

Matching: BIA Metrics

Match each metric (1–4) to its correct description (A–D).

1RTO

2RPO

3MTTR

4MTBF

AThe maximum acceptable amount of downtime for a system or service after a failure; defines how quickly service must be restored

BA reliability metric calculated as Total Uptime divided by Number of Breakdowns; higher values indicate greater reliability and longer time between failure events

CThe average time required to repair a failed system, calculated as Total Repair Time divided by Number of Repairs; should be lower than RTO

DThe maximum acceptable data loss measured in time; drives backup frequency decisions by specifying how old the most recent usable backup can be

Business Impact Analysis — Quiz