Knowing What Actually Matters
You cannot protect everything to the same degree, and the organisations that try end up protecting nothing well — the budget is spread so thin that the crown jewels get the same thin coat as the office coffee-machine dashboard. Business impact analysis is the unglamorous survey work that tells you where the value and the danger actually sit, so tiering can put the money where the harm is. It is mostly interviews, spreadsheets, and the deflating discovery that the system everyone forgot about turns out to hold the whole enterprise up. Do the survey before the disaster does it for you. The disaster's version is more accurate and much more expensive.
Knowledge check
During a business impact analysis, a team discovers that a small, low-traffic identity service — one nobody had flagged as important — must be running before any of the customer-facing systems can authenticate users. How should this change the service's tier, and what general principle does it illustrate?
Show the answer
The identity service should be tiered at least as high as the most critical system that depends on it, because those systems cannot recover until it does — its recovery objectives effectively become a floor for everything downstream. The general principle is that criticality follows dependency, not visibility or traffic: a small, quiet component that others cannot function without inherits the criticality of what it supports. Business impact analysis exists precisely to surface these hidden load-bearing dependencies before an outage reveals them.