Business impact analysis (BIA) is an essential component of an organization's business continuity plan; it includes an exploratory component to reveal any vulnerabilities, and a planning component to develop strategies for minimizing risk. The result of the assessment is a business impact analysis report, which describes the potential risks specific to the organization studied. BIA is likely to identify costs linked to failures, such as loss of cash flow, replacement of equipment, salaries paid to catch up with a backlog of work, loss of profits, and so on.

Business Continuity and Disaster Recovery testing should be performed annually as a requirement and quarterly or as needed when a large corporate change has been introduced. 

Disaster Recovery testing should include the people and data. People are the most important segment of information security and all contingencies should be accounted for. 

The participants of the disaster recovery plan should include all decision makers and department heads. Lead by your Chief Security Officer, all aspects of the business that are technical and non technical should be highlighed, weighted and prioritized as it realtes to people, safety, business revenue, customer service and restoration. 

The participants should also be assigned their specific roles in the event a disaster arises.