---
sourceDocument: Xanadu Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/governance-risk-compliance

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Assess impact categories and dependencies of process

# Assess impact categories and dependencies of a process {#ariaid-title1}

* Release version: Xanadu
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read

Assess the different components of a business impact analysis (BIA). First by
assessing and determining the impact categories of a business process. Second, by
identifying any underlying dependencies that the business process requires across different
dependency types.

## Before you begin

Role required: sn_bcm.program_manager or sn_bcm.planner

## Procedure

1. Navigate to Business ContinuityBusiness Continuity Workspace.
2. Click the lists icon (![Lists icon]()).  
   By default the records in the In Draft state of the Business Impact Analysis list opens.
3. To create a business impact analysis (BIA) record, click New.
4. To update an existing BIA, click the link to the record in the Name column.  
   You can view different cards that give the information on the impact
   assessment result, its progress, and the dependencies of the business
   process on business application, hardware, software, or vendors.  
   Figure 1. BIA impact assessment and dependency views

   Impact Assessment Result

   :   This card provides the assessment results of the recovery tier
       level and the recovery time objective for the item that is
       assessed.

       * Recovery Point Objective (RPO): Metric that evaluates the data loss during the business disruption duration that can exceed the tolerance level. RPO results appear in the Impact Assessment Result card only when the primary element assessed in the BIA requires data backup. Otherwise the card shows only the Recovery Time Objective (RTO) and recovery tier results.
       * Recovery Time Objective: Metric that calculates how quickly the business must recover an element or an item after a disruption. RTO is measured in terms of how long your business can survive following a disaster before operations are restored to normalcy. If the RTO is four hours and the item recovered is beyond four hours, then your business could suffer quite some loss.
       * Recovery Tier: Organizations differ in defining recovery tiers depending on the item and the time by which it should be recovered on the state of a crisis. A recovery time objective of Immediately, 1 hour, or 4 hours is impending and falls within the Mission Critical recovery tier level. On the other hand, an RTO of two weeks to one month can be graded as a Non-Essential recovery tier, which may not incur considerable loss to the business.

       {#assess-impact-categories-bia__ul_uvl_dnx_vmb}  
       Note:  
       You can configure the mapping of recovery tiers to RTOs as per your requirement.  
       Figure 2. Impact assessment result

   Impact Assessment Progress

   :   This component indicates the categories of impact that you have
       assessed and completed in relation to the categories that are
       assessment pending. As you complete the assessment for each
       category of impact, you can see the progress of the
       Impact Assessment Progress ribbon
       component. The color-coded ribbon component prompts you to
       complete the assessment for the pending impact categories.

       Figure 3. Impact assessment progress component

   Dependent Assessment Progress

   :   Identifies the dependency of the business process on different
       asset classes or types for its functioning. The assessment
       identifies the relationship between the business process and the
       business application, software, workplaces, or vendors. Or, the
       asset types that the process uses. The progress of the
       dependency assessment pie chart advances as you complete
       assessing the business applications, software or hardware, and
       vendors that the business process depends on.

       Figure 4. Dependency assessment progress pie chart

   BIA SLA

   :   The business impact analysis also requires a specific time by
       which the assessment of a business process must be completed. By
       default, the SLA timer is set to 30 days and it marks the time
       since the BIA is drafted, which is In Draft state, until the time it is complete,
       which is Approved state.

5. To assess the different types of business impact categories on the business process, click the RTO Impact Assessment tab.  
   All impact categories are configurable. A business process draws a set of impact categories, by default, from the template that you have used for the business impact analysis. For more information, see: [Review an impact category and assess
   its downtime](https://www.servicenow.com/docs/GCHej_8pT7k_hPF5Ug_f2A "Review the impact categories and define the timeframe during which the organization would experience the downtime of its business processes. Analyze the downtime or disruption duration, which helps to determine the recovery time objective for the asset that is assessed.").
6. To answer questions on the data value of the asset in terms of its impact on the business and its data change frequency, click RPO Impact Assessment tab.  
   For more information, see [Assess RPO impact of technology assets on the business](https://www.servicenow.com/docs/lJ7vckQzOEfDlPcMJ67lqQ "Use the RPO impact assessment tab to enter asset information. The information can be critical from the objective of its recovery, the data value of the asset, and the frequency at which the data changes in the asset.").
7. To review the dependency groups and identify the items within each group that your business process depends on, click the Dependency Assessment tab.  
   You can prioritize your business continuity and recovery plans based on the criticality of the assets that your business process utilizes. For more information, see: [Identify
   dependent items to prioritize recovery plans](https://www.servicenow.com/docs/dae5fTok0f3H_S_Ju4tffA "Use the Dependency Assessment tab to identify items or assets that belong to a definite object type or a dependency group.").

   Order of impact categories
   :   The order in which the impact categories appear in the
       RTO Impact Assessment, RPO Impact Assessment, and Dependency Assessment tabs depend on the order in which the
       impact categories are created in the template that is used in the
       BIA.

       The order of impact rating in the RTO impact assessment
       grid and the order of the questions in the RPO impact assessment
       grid are defined by the impact rating scale and the impact
       analysis questions in the BIA, respectively.

       However, any
       user who can access the BIA can change the order of the RPO
       impact grid, RTO impact categories, and dependency
       groups.

   Columns in dependency group grid

   :   If you had set up column configurations for an element of a
       dependency group and enabled your grid configuration as active,
       then you can view those columns in the dependency grid for the
       corresponding dependency group in which element definition
       matches with the grid configuration element definition.

       Otherwise, you can view the grid that is rendered based on the
       configured view; that is either IT asset or non-IT asset view
       based on the required data backup value of the dependency
       group.  
       Figure 5. Grid columns for dependency assessment Figure 6. Grid configuration setup  
       For ad hoc reporting of variables created for dependency: Add the columns in Dependency report source \[sn_bia_dependency_report_source\] table to match the variables that you defined in Element variable where the Enable reporting option is set to true. A scheduled job that runs weekly:
       * retrieves the
         * dependencies (sn_bia_dependency), where the impact analysis is in approved state, updated in the last seven days, and has not expired, and the
         * corresponding element
         {#assess-impact-categories-bia__ul_ohn_n5d_vsb}
       * and updates the data in the reporting table.
       {#assess-impact-categories-bia__ul_e2m_k5d_vsb}

       To display the columns that you require you must set up the [element
       variable](https://www.servicenow.com/docs/pkysDazumfPiZl2P~lNxGQ "As a functional system administrator, you can set up an element variable that is specific custom columns, which are required for a particular dependency of an element.") and [grid configuration](https://www.servicenow.com/docs/jAR7kdLhXmrbxVa4dGY8IA "Set up the grid configuration to render the BIA dependency assessment grid with configured columns."). For more information, see, [Grid configuration for column display](https://www.servicenow.com/docs/0Npjoy5QYNIvRKvTnYAAGw "Grid configuration for column display helps you to capture specific columns in the dependency grid that corresponds to an element.").
8. To change the order of appearance of the impact categories in RTO, RPO, and dependency groups in dependency assessment, navigate to Business ContinuityBusiness Impact AnalysisImpact Category Results.
   1. Click the impact analysis record.
   2. To change the order of the impact categories for RTO and RPO, click the Impact Category Results related list and change the order in the Order column.
   3. To change the order of dependency groups, click the Impact Dependency Groups related list and change the order.
   {#assess-impact-categories-bia__substeps_tgr_z1v_1rb}
* **[Review an impact category and assess its recovery time](https://www.servicenow.com/docs/GCHej_8pT7k_hPF5Ug_f2A)**   
  Review the impact categories and define the timeframe during which the organization would experience the downtime of its business processes. Analyze the downtime or disruption duration, which helps to determine the recovery time objective for the asset that is assessed.
* **[Assess RPO impact of technology assets on the business](https://www.servicenow.com/docs/lJ7vckQzOEfDlPcMJ67lqQ)**   
  Use the RPO impact assessment tab to enter asset information. The information can be critical from the objective of its recovery, the data value of the asset, and the frequency at which the data changes in the asset.
* **[Identify critical dependencies to prioritize recovery plans](https://www.servicenow.com/docs/dae5fTok0f3H_S_Ju4tffA)**   
  Use the Dependency Assessment tab to identify items or assets that belong to a definite object type or a dependency group.
* **[View business impact analysis details](https://www.servicenow.com/docs/~EDBbzr3wBwMOe5s3Nne8g)**   
  Use the Details tab to view the general information of the business impact analysis. You can also adjust the recovery time objective and recovery point objective results of the primary element as per your requirement.
* **[View approval state flows for a business impact analysis](https://www.servicenow.com/docs/whGTXeoxyxWarg6ZuzRHlw)**   
  View the approval state transitions sent at each level of the approval process, and the details of the approvers as you direct the business impact analysis through multiple levels of approvals.
* **[Update dependency details of a BIA in Self Service](https://www.servicenow.com/docs/QLKdh3anaiO9xs83kuV1pg)**   
  Use contributor role to update the disruption duration of the impact category result, RPO Impact analysis responses, state of the impact dependency group, and the work notes in the Activity related item.

*[\>]: and then