---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Assess impact categories and dependencies

# Assess impact categories and dependencies {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read

Assess the impact categories and dependencies in BCM UIB Workspace to get the necessary information for a plan. Use the business impact analysis to identify the recovery time objective for an item and prioritize the assets that have the least and most critical
dependencies. Use the information to establish their recovery strategies during the planning phase.

## Before you begin

Role required: sn_bia.bia_admin, sn_bcm.program_manager, sn_bcm.planner, sn_bcm.contributor or sn_bia.bia_contributor (can respond to BIAs in which they are tagged as a contributor)

## About this task

Beginning with the Xanadu release, these new columns are added to the BIA dependency tables. The values of these columns can be refreshed by selecting the Update dependencies button in the Dependency assessment.

* Related item BIA - The latest unarchived impact analysis done on the dependency item
* Related item RTO - The Recovery time objective of the above impact analysis. It will take the value of adjusted RTO instead of RTO if there is any.
* Related item RPO - The Recovery point objective of the above impact analysis. It will take the value of adjusted RPO instead of RPO if there is any.
* Related item recovery tier - The recovery tier of the above impact analysis.
{#assess-impact-categories-bia-in-uib-ws__ul_nhj_fs5_bcc}

## Procedure

1. Navigate to WorkspacesBusiness Continuity Workspace.
2. To update an existing business impact analysis, select the link to the business impact analysis record in the Name column and navigate to the Assessments tab.
3. To assess different types of business impact categories on the business process, select the Recovery time objective assessment tab.  
   A sample questionnaire for the Recovery time objective assessment (RTO assessment) is shown in the example.You must configure all impact categories in the Recovery time objective assessment. A business process draws a set of impact categories, by default, from the template that you have used for the business
   impact analysis. For more information, see: [Review an impact category and assess its downtime](https://servicenow-prod.fluidtopics.net/Bozd5taN2W4cY~Blx_WcMg "Review the impact categories and define the timeframe during which the organization would experience the downtime of its business processes. Analyze the downtime or disruption duration, which helps to determine the recovery time objective for the asset that is assessed.").
4. Respond to the questions in the Recovery time objective assessment questionnaire and select Next.  
   For information on recovery time objective and calculation of recovery time objective, see [RTO, RPO, and recovery tiers](https://servicenow-prod.fluidtopics.net/Wh5z_rJqnZ6TQ6Pxiu8CoA "Due to unforeseen disruptive events, the business processes in your organization can face a downtime. Therefore, it is important to classify your business processes in the recovery tiers. You can then calculate the amount of time and amount of data loss that your organization can handle without significant effect on the operations.") and [Calculating RTO and RPO](https://servicenow-prod.fluidtopics.net/2kl3WhPogzjnazBQqPvREA "The BCM application provides an assessment questionnaire for calculating the recovery time objective (RTO) and recovery point objective (RPO) in the business impact analysis (BIA). As a pre-requisite to the BIA, BCM administrator defines the impact ratings and sets up the assessment questions. After receiving the responses to the assessment, the BCM application calculates the RTO and RPO.").
5. To answer questions related to the data component of the asset, select the Recovery point objective assessment tab.  
   A sample assessment questionnaire for the Recovery point objective assessment (RPO assessment) is shown in the example. You must configure all impact categories in the Recovery point objective assessment. For more information, see [Assess RPO impact of technology assets on the business](https://servicenow-prod.fluidtopics.net/4QZFXpOCV1cWzzH10PZ3nw "Use the RPO impact assessment tab to enter asset information. The information can be critical from the objective of its recovery, the data value of the asset, and the frequency at which the data changes in the asset."). For information on recovery point objective and calculation of recovery point objective, see [RTO, RPO, and recovery tiers](https://servicenow-prod.fluidtopics.net/Wh5z_rJqnZ6TQ6Pxiu8CoA "Due to unforeseen disruptive events, the business processes in your organization can face a downtime. Therefore, it is important to classify your business processes in the recovery tiers. You can then calculate the amount of time and amount of data loss that your organization can handle without significant effect on the operations.") and [Calculating RTO and RPO](https://servicenow-prod.fluidtopics.net/2kl3WhPogzjnazBQqPvREA "The BCM application provides an assessment questionnaire for calculating the recovery time objective (RTO) and recovery point objective (RPO) in the business impact analysis (BIA). As a pre-requisite to the BIA, BCM administrator defines the impact ratings and sets up the assessment questions. After receiving the responses to the assessment, the BCM application calculates the RTO and RPO.").
6. Respond to the questions in the Recovery point objective assessment and select Next.  
   You can respond to the questions and complete the Recovery point objective assessment.
7. To assess the dependencies and identify the items within each dependency that your business process depends on, select the Dependency Assessment tab.  
   You can select the dependency in the Dependency panel to view the group and items that belong to that group. For example, if the group is Locations, you can select one or more locations and
   assess the dependencies associated with them. A sample Dependency assessment is shown in the example.
8. To add an item to a dependency group, select one of the options.

   | Step | Description |
   | Add | Add an item from all the records. The relationship source is BCM. All items from the respective table, irrespective of its relationship in the CMDB are displayed. When you select Add, the filter for selecting the dependencies is displayed as shown in the example: To update the selected dependency item, you can add details and select Update. * Depends on * Required Recovery Timeframe * Required Data Backup * Description of Use * Additional details - Comment {#assess-impact-categories-bia-in-uib-ws__ul_rpb_lsz_dyb} A sample assessment is shown in the example. Note: The Add and Add first level CMDB dependencies actions are available only while the business impact analysis is in an editable state, such as Draft or Returned. After the business impact analysis is submitted and moves to the Pending approval state, these actions are no longer available, so you cannot add dependency items to the assessment in that state. |
   | Add first level CMDB dependencies | Add dependencies for which the relationships are identified in CMDB. Note: Both the Add and Add first level CMDB dependencies UI actions mark the dependency source as Manual because inserting the dependency is a manual action. The CMDB source is used only when dependencies are automatically inserted by the application through the Update dependencies action. The Add first level CMDB dependencies UI action streamlines the manual addition of dependencies by pre-filtering the list to show only CMDB relationships, rather than displaying all CI items within an element definition. A sample assessment is shown in the example. |
   | Update dependencies | Import all CMDB relationships manually in the respective categories that are defined in the instance. |
   | Edit Required Recovery Timeframe (RTO) for one dependency | If you have one dependency in the Pending state, you can update its RTO by updating the inline value in the Required Recovery Timeframe field as shown in the example. |
   | Edit Required Recovery Timeframe for multiple dependencies | Similarly, you can update the RTO for multiple dependencies as shown in the step-by-step examples: 1. Select multiple dependencies. 2. Select Edit. The Edit items Dependency panel is displayed. 3. Update the RTO for multiple dependencies in the Required recovery Timeframe field. RTO is updated for multiple dependencies and the dependency assessment is marked as Complete. If you edit the RTO for one dependency, the dependency assessment moves to the Pending state. {#assess-impact-categories-bia-in-uib-ws__ol_dtv_r45_2yb} When you have updated the RTO value for all entries in the Required Recovery Timeframe field, then that particular category of dependency is marked as Complete by the application. Note: If the administrator has set the Required Recovery Timeframe field in the dependency assessment as mandatory, the BIA user can update the required recovery timeframe for the dependency assessment. If the administrator has set the Required Recovery Timeframe field in the dependency assessment as optional, the BIA user can complete the dependency assessment without updating the Required Recovery Timeframe field. Data from the Required Recovery Timeframe and Required Data Backup columns is now pulled into the BCP record. |
   | Select Complete | This is the final step. You must complete all the pending assessments before selecting Complete. Selecting Complete marks all the assessments in the business impact analysis as Complete. Note: After selecting Complete, if you see the message that the dependency groups are in the Not started state, you must complete the procedures explained in this table for single and multiple dependencies. Selecting Confirm in the message window marks all dependency groups as Complete without actually completing them. |
   |-|-|

   {#assess-impact-categories-bia-in-uib-ws__choicetable_fjs_hqz_dyb}  
   You can prioritize your business continuity and recovery plans based on the criticality of the assets that your business process uses.  
   Note:  
   Add all required dependency items before you submit the business impact analysis for approval. After submission, the assessment is locked and you cannot add dependencies until the business impact analysis is returned to an editable state.  
   The completed assessments are shown in the example. The state of each assessment is marked as Complete and it is highlighted in Green. You can open the completed assessments and view their details for reference at any time.

9. Select Submit for review.  
   Note:  
   Before submitting the business impact analysis for a review, verify that all assessments are complete and the name of the BCM lead is updated in the BCM Lead field on the Details tab.  
   The business impact analysis is submitted for a review to the BIA owner or BCM lead. The business impact analysis is updated to the In Review state.
10. Review the assessments in the business impact analysis if you are the BIA owner or BCM lead.  
11. Select Submit for approval.  
    The business impact analysis is updated to the Pending approval state.  
    Note:  
    If an approval record is already created for a BIA, the Approve or Reject buttons are not displayed in the BIA form.
12. Select Save.
13. Select the Generate PDF button to generate the BIA in a PDF format.  
    A message appears that the PDF has been generated.Figure 1. PDF download

    Select the link in the message to download the PDF.
    * If you have view-only access to the BIA, the option to generate a PDF helps you to download the document to your local hard drive.
    * You can download the BIA before its Approval state.
    * By default, the PDF is generated and attached after the BIA is approved.
    {#assess-impact-categories-bia-in-uib-ws__ul_c2s_l3l_hrb}
14. To move a BIA from Approved to Draft state, select the Edit button.
15. To create a copy of the BIA, select the Copy button.  
    If you have the permission to read and create a BIA, then you can also copy the BIA.
    1. Enter the name of the new BIA in the Copy impact analysis pop-up.  
       The copy action creates an exact replica of the BIA with the name that you enter in the Copy impact analysis pop-up. It also copies all its dependencies and dependency groups on to the new BIA.
    2. Select Confirm.  
       * The new BIA that is copied from the original BIA has all the RTO, RPO impact, dependency assessment structural details similar to the original BIA.
       * However, the impact category details for each of these assessments are editable for you to assess the dependency details exclusively for the copied BIA.
       * When a BIA that has the RTO or RPO impacted assessments completed is copied, the new copied BIA won't have the new assessment in the Pending state. If impact categories of RTO and RPO impact assessments in original BIA are in Complete state, the impact categories in copied BIA are in the Complete state.
       * Therefore, you must assess and enter the disruption duration, response, and required recovery timeframe relevant to the copied BIA.
       * You can assess the details in the Results section. The RTO and RPO values are recalculated after you complete the assessments.
       * Activities and Work notes are not copied to the new BIA. Enter this information relevant to the new BIA.
       * Any attachments attached to the original BIA in any format are copied to the new BIA. However, the PDF generated for the original BIA using the Generate PDF button is not copied to new BIA as the assessment data pertains to original BIA. Since you have flexibility to modify assessment details in the copied BIA and generate a PDF, copying the PDF generated for the original BIA has no relevance.

       {#assess-impact-categories-bia-in-uib-ws__ul_p4l_d1v_tsb}  
       Note:  
       You can delete a BIA (and its related tables) that is in the Draft state. BCM planner and program manager can delete a BIA that is in the In Review and Returned states, whereas a BCM admin can delete a BIA irrespective of its state.
    {#assess-impact-categories-bia-in-uib-ws__substeps_mkp_fy3_lsb}

*[\>]: and then