<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-business-impact-analysis
description: >-
  Assess and quantify the business impact of security incidents including
  financial loss estimation, operational disruption measurement, regulatory
  exposure calculation, and reputational damage scoring.
domain: cybersecurity
subdomain: incident-management
tags:
  - business-impact
  - risk-assessment
  - financial-impact
  - bia
  - incident-cost
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["ID.RA-4", "ID.RA-5", "RS.AN-2"]
  frameworks: ["NIST SP 800-34", "ISO 22301", "FAIR"]
---

# Performing Business Impact Analysis

## Overview

Business impact analysis (BIA) during incidents quantifies the actual and
projected cost of a security event across financial, operational, regulatory,
and reputational dimensions. Accurate BIA drives prioritization of response
actions and informs executive decision-making during active incidents.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Asset inventory with business value | Maps systems to revenue impact |
| Regulatory requirement matrix | Notification deadlines and fine schedules |
| SLA documentation | Customer-facing service commitments |
| Financial models | Revenue-per-hour, cost-of-downtime baselines |

## Key Concepts

### Impact Dimensions

```
BUSINESS IMPACT MATRIX
│
├── FINANCIAL
│   ├── Direct loss (fraud, theft, ransom payment)
│   ├── Revenue loss (downtime × hourly revenue)
│   ├── Recovery cost (IR team, forensics, remediation)
│   └── Legal cost (litigation, settlements)
│
├── OPERATIONAL
│   ├── Service downtime (SLA breach duration)
│   ├── Productivity loss (affected employee-hours)
│   ├── Supply chain disruption (partner impact)
│   └── Data loss (unrecoverable records)
│
├── REGULATORY
│   ├── Notification obligations (GDPR 72h, HIPAA 60d)
│   ├── Fine exposure (GDPR: 4% annual revenue)
│   ├── Audit requirements (mandatory post-breach audit)
│   └── License/certification risk (PCI DSS, SOC 2)
│
└── REPUTATIONAL
    ├── Customer churn (projected attrition rate)
    ├── Brand damage (media coverage score)
    ├── Stock impact (public company share price)
    └── Trust erosion (NPS/CSAT impact)
```

### FAIR Risk Quantification

| Factor | Description | Example |
|--------|------------|---------|
| Loss Event Frequency | How often the event occurs | 0.1–0.5 per year |
| Threat Event Frequency | How often threats act | 10–50 per year |
| Vulnerability | Probability of success | 0.01–0.05 |
| Primary Loss | Direct financial impact | $100K–$5M |
| Secondary Loss | Indirect costs (fines, reputation) | $500K–$50M |

### Severity-to-Impact Mapping

| Severity | Revenue Impact | Recovery Time | Regulatory Risk |
|----------|---------------|---------------|-----------------|
| S1 Critical | > $1M/hour | > 72 hours | Mandatory notification |
| S2 High | $100K–$1M/hour | 24–72 hours | Likely notification |
| S3 Medium | $10K–$100K/hour | 4–24 hours | Internal review |
| S4 Low | < $10K/hour | < 4 hours | Minimal |

## Workflow

1. Identify affected systems and map to business services
2. Calculate direct financial exposure (downtime × revenue rate)
3. Assess regulatory notification obligations and fine exposure
4. Estimate operational disruption (affected users, processes)
5. Project reputational impact using historical benchmarks
6. Aggregate into total impact score with confidence intervals
7. Present executive summary with recommended response investment

```bash
# Calculate incident business impact
node agent.js calculate --incident-id INC-2026-0200 \
  --affected-systems '["payment-api","user-db"]' \
  --downtime-hours 4.5 --records-exposed 50000

# Generate executive impact summary
node agent.js executive-summary --incident-id INC-2026-0200

# Estimate regulatory exposure
node agent.js regulatory-exposure --jurisdiction gdpr --records 50000
```

## Verification

- [ ] Impact assessment completed within 2 hours of severity assignment
- [ ] Financial estimates include confidence intervals
- [ ] Regulatory obligations identified with notification deadlines
- [ ] Executive summary generated with actionable recommendations
- [ ] Impact figures validated against historical benchmarks

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- NIST SP 800-34
