Business impact analysis (BIA) software collects what each process owner knows about the impact of a disruption, turns it into recovery objectives (MTPD, RTO, RPO) and records the resources each process needs to restart. ISO 22301 sets the requirement in clause 8.2.2 and ISO/TS 22317 gives guidance on the method; neither requires a tool. Software earns its place when you run the BIA every year across dozens of processes and owners.
This comparison reviews 12 products that present a BIA capability on their own pages. Every statement comes from the vendor's page or a public source listed at the end, checked on 1 November 2026. When a vendor does not describe something (a calculation, a price, a hosting region), we write "Not described" or "Not published" instead of guessing.
Disclosure: this article is published by ResiPlan, which is one of the products listed. We applied the same grid to everyone, ourselves included, and we do not rank the products: the right tool depends on your size, sector and obligations.
Key takeaways
- The products differ most on two points: whether recovery objectives are calculated from impact ratings over time, and whether the BIA feeds the plans without re-keying.
- Calculation methods are rarely published. ServiceNow documents its RTO logic in detail; GlobalSuite, BCMmetrics and ResiPlan describe how theirs are derived; most other vendors only say the RTO is "set" or "captured".
- Public prices are rare: ResiPlan and Riskonnect (UK public catalogue) are the only two we found. Everbridge offers a limited free trial through the same catalogue.
- Before signing, run one real process through a trial or demo: send the questionnaire to its owner, check how the RTO is derived, and see whether the result appears in the plan.
BIA software comparison table
| Product | Questionnaires and campaigns | Impact categories over time | MTPD / RTO / RPO | Dependencies | BIA feeds the plans | Reporting | Public price | Stated hosting |
|---|---|---|---|---|---|---|---|---|
| ResiPlan | Campaigns to process owners or invited contributors, reminders, approval | Yes: configurable criteria rated per time window | MTPD and RTO suggested from the grid; RPO entered | People, skills, IT systems, workstations, equipment, suppliers, vital records, per site | Yes: plan pre-fill and resources per plan | Analytics, gap view, Excel campaign workbook | From €199/month excl. VAT (annual) | EU (Ireland, France) |
| BCMmetrics | Questionnaire links with completion notifications | Categories you choose; time scale not described | RTO and RPO derived from your scores; MTPD not mentioned | Applications, internal and external dependencies, locations | Yes: BCM Planner pulls BIA data | Reports, graphs; Excel, Word, PDF export | Not published | Not published |
| Fusion | Not described ("capture BIA data") | Not described | Not described | People, processes, places, systems, third parties | Yes: plans kept aligned with the BIA | Executive reporting, dashboards | Not published | Salesforce-managed platform, regions not published |
| Riskonnect | Data collection from process owners; guided templates | Yes: financial, operational, reputational, regulatory, over time | RTO and RPO set through the BIA; method not described | Dependency mapping, types not listed | RTO/RPO drive recovery strategies; transfer to plans not described | Scorecards, dashboards, gap analysis | £24,000/year up to 250 employees (UK G-Cloud 15) | Azure; UK, EEA or other, customer's choice |
| Everbridge BC in the Cloud | Built-in BIA templates; questionnaires not described | Customisable impact scales; time scale not described | Customisable RTOs; criticality calculated | Resource dependencies, customisable models | Not described | BIA completion status, plan readiness | Not published (limited free trial) | EEA (UK G-Cloud 15) |
| Mitratech Preparis | Self-guided data collection workflow | Not described | RTOs needed for technologies | IT and third parties | BIA data defines recovery strategies | Default reports, dashboards | Not published | Global hosting, regions not published |
| Noggin | Activity reviews e-mailed to owners through a workflow | Not described | Maximum periods of disruption (MTO) | Third parties, staff, assets, vendors | Not described | BIA dashboard, report approval, PDF/Word | On quote | Not published |
| ServiceNow BCM | BIA owner completes a configured assessment | Yes: each impact rating tied to a disruption duration | RTO calculated from the first non-tolerable rating; RPO from scores; recovery tiers | Applications, hardware, software, vendors, workplaces | Not described in the documentation checked | Not described in the documentation checked | Not published | Not published |
| Archer | One BIA process across the organisation; campaigns not described on the page checked | Not described | Tolerance thresholds; RTO not described | Business services and dependencies | Processes, dependencies and recovery actions mapped together | One reporting structure for every BIA | Not published | On-premises or SaaS |
| GlobalSuite | Configurable questionnaires to each owner, consolidated automatically | Not described (BIA history kept) | MTPD, RTO and RPO per process, consolidated | Assets, critical suppliers | Shared processes and assets with plans | BIA reports, Word and Excel export | Not published | European regions |
| Continuity2 | Online wizard | Customisable impact categories, timelines and tolerances | Recovery requirements captured; calculation not described | Resources and dependencies, types not listed | Yes: "feeds directly" into planning | BIA reporting tools | Not published | Not published |
| MAPSI | Not described | Impacts recorded; time scale not described | RTO and RPO tracked | Applications, services | Activities, impacts, risks and plans linked | Continuity dashboards | Not published | Not published |
"Not described" means the vendor's pages we checked do not present the capability; it may still exist, so ask for it in a demo. Links are in the Sources section.
How we compared
We used the eight questions a BIA owner asks before choosing a tool:
- Questionnaires and campaigns: can the tool send the BIA to process owners, chase them and collect an approval?
- Impact categories over time: are financial, operational, legal, reputational and other impacts rated at several points in time (1 hour, 1 day, 1 week...)?
- MTPD, RTO and RPO: are the objectives calculated or suggested from those ratings, or typed in by hand?
- Dependencies: are IT systems, suppliers, people and sites recorded per process?
- BIA feeding the plans: do recovery objectives and resources flow into the continuity plans?
- Reporting: dashboards, exports, campaign progress.
- Public price and 8. stated hosting.
For the method itself, see our BIA guide, the business impact analysis overview and our explainer on RTO, RPO and MTPD.
Specialist BIA and continuity tools
ResiPlan
ResiPlan, published by a Belgian company, runs the BIA as part of its continuity module:
- Campaigns: one questionnaire per process, sent to the process owner or to a contributor invited by e-mail, with deadlines, reminders and an approval workflow (submit, approve or return). Group campaigns cover several entities, and every BIA keeps a version history.
- Impact over time: each organisation configures its criteria (financial, operational, customer, regulatory, reputational and safety by default) and time windows (from 1 hour to 1 month by default). The MTPD is suggested as the first window where an impact reaches the tolerance threshold, and the RTO as the window before it; the values you validate are the ones stored.
- Dependencies: resource requirements per process (people, skills, IT systems, workstations, equipment, suppliers, vital records) by recovery tier and by site, checked against the RTO and MTPD.
- Link to plans: a new continuity plan can be pre-filled from a BIA, plans list the BIAs they cover, and the resources needed at each tier are totalled per plan.
- Start-up: business processes can be seeded from your sector's template.
- Price: from €199 per month excl. VAT, billed annually (Essentials, up to 10 users); free 7-day trial, no credit card.
- Hosting: database in Ireland (Convex EU deployment on AWS), web servers at OVHcloud in France.
- Caveat: the software structures and evidences the analysis; impact ratings and recovery objectives remain decisions for your management.
Module details: ResiPlan business continuity software.
BCMmetrics
BCMmetrics, created by the team behind US consultancy MHA Consulting (Glendale, Arizona), sells its BIA as a separate module, BIA On-Demand. You share links to "pre-work questionnaires" and are notified when they are completed. Impact categories are yours to choose (financial, operational and reputational are given as examples), and the module "automatically defines critical process RTO and RPOs based on the scores assigned by you". Processes can be tied to applications and locations. The companion BCM Planner module pulls BIA data into recovery plans. Reports include departmental overviews and process rankings by RTO, exportable to Excel, Word or PDF. Prices are on request; the pricing page mentions up to four admin users with unlimited standard users and bundle discounts. Hosting is not published.
Continuity2
UK vendor Continuity2 (offices in Glasgow, Dubai and New York) uses an online wizard that "guides users through the data collection process". Impact categories, timelines and tolerances can be tailored, and the BIA captures supporting activities, resources, dependencies and recovery requirements. The vendor states that "your BIA feeds directly into your overall planning". Prices and hosting are not published.
GlobalSuite Business Continuity
Spanish vendor GlobalSuite sends "configurable questionnaires to each owner" and consolidates them automatically, giving each business process "its MTPD, RTO, RPO and criticality, consolidated from its BIAs", with a BIA history. Assets and critical suppliers are shared with the other modules of its GRC suite, and reports export to Word and Excel. ISO 22301 and ISO 27031 come preloaded. Its trust centre states infrastructure "located within the European area"; pricing on request.
MAPSI
MAPSI, developed by OLING (Issy-les-Moulineaux, France), helps formalise the BIA and track RTO and RPO, links critical processes to applications, services and dependencies, and connects activities, impacts, risks and plans in one structure, with continuity dashboards. Price and hosting are not published.
Enterprise and GRC platforms
Fusion
Fusion (Fusion Risk Management) lets teams "capture business impact analysis data" and maps relationships across "people, processes, places, systems, and third parties". It states that it keeps each continuity plan "aligned with current business impact" and links exercises to the BIA, with executive-ready reporting. The page does not describe the questionnaire or the RTO method. Its trust centre lists a Salesforce-managed platform; regions and price are not published. ResiPlan vs Fusion.
Riskonnect (including Castellan)
Riskonnect describes "automating data collection from process owners", impacts that are "financial, operational, reputational, and regulatory" assessed "over time", and RTOs and RPOs "established through the BIA process" that "drive decisions about recovery strategies"; how BIA data reaches the plans is not described. Its UK G-Cloud 15 listing adds guided BIA templates, dynamic dependency mapping, pre-built reports and gap analysis. The January 2026 G-Cloud 15 price list shows £24,000 per year for an organisation of up to 250 employees, including BIAs, plans, exercising and reporting, plus a £20,000 standard implementation; service-level BIAs are an Operational Resilience add-on. Hosting is on Azure, with UK, EEA or other locations at the customer's choice. For a detailed comparison, see Riskonnect BIA: a European alternative and ResiPlan vs Riskonnect.
Everbridge BC in the Cloud
BC in the Cloud, now part of Everbridge, includes "built-in templates for business impact analysis", with a BIA that calculates "the criticality of business functions/processes" and analyses resource dependencies. Its UK G-Cloud 15 listing (resold by Softcat) states that customers can "customise BIA templates, impact scales, RTOs, dependency models", that reporting covers BIA completion status and plan readiness, and that data is stored in the EEA. A limited free trial includes the BIA; no price is published. ResiPlan vs Everbridge.
Mitratech Preparis
Mitratech Preparis "walks you through data collection in a simple, self-guided workflow", reviews process dependencies on IT and third parties and the RTOs needed for technologies, allowing "the data to define your recovery strategies and controls". The vendor cites "hundreds of default reports" and dashboards. Mitratech describes "secure, global hosting" without naming regions; pricing is not published.
Noggin
Noggin, part of Motorola Solutions, offers built-in BIA tools to "identify critical activities" and "determine maximum periods of disruption". Prioritised activity reviews are e-mailed to activity owners and guided by a workflow; the module includes a BIA dashboard and a "BIA report and approval workflow". Dependencies on third parties, staff, assets and vendors can be identified. Pricing is a sales estimate; hosting is not published. ResiPlan vs Noggin.
ServiceNow Business Continuity Management
ServiceNow BCM, an application of the ServiceNow platform, documents its method in detail. An administrator defines impact categories and ratings, each tied to a disruption duration; the BIA owner answers the assessment. "The disruption duration for the first non-tolerable impact category is selected for the recovery time objective (RTO)", the RPO comes from the highest score mapped to a timeframe, and the RTO sets a recovery tier. BIA templates group dependencies into "Applications, Hardware, Software, Vendors, Workplaces". The documentation we checked does not cover the link to plans or reporting. No price or hosting region is published on the pages we could access.
Archer
Archer offers a "single process, repository, and reporting structure for every business impact analysis", defines critical business services and their dependencies with tolerance thresholds, and maps "critical processes, dependencies, and recovery actions" in one platform. The page we checked does not describe questionnaires or campaigns. Archer states its platform deploys "on-premises or SaaS"; the pricing page shows no figures. ResiPlan vs Archer.
Adjacent options
- A spreadsheet or template is enough for a first BIA on a handful of processes; our free BIA template follows the same structure as the tools above.
- Products that name the BIA without describing it: Quantivate and ParaSolution list business impact analysis in their continuity software, but their product pages describe no questionnaire, impact scale or RTO calculation, so we left them out of the table. Check those points in a demo.
- CMDB and IT dependency-mapping tools document what IT systems depend on, not the business impact of losing them; they complement a BIA rather than replace it.
For full continuity suites (plans, exercises, crisis management), see our business continuity software comparison.
How to choose
- First BIA, fewer than 20 processes: start with the template, then move to software when you repeat the exercise every year.
- Many process owners across sites or entities: favour questionnaires, reminders and approvals (campaigns), so the BIA team stops chasing answers by e-mail.
- Audit or regulator scrutiny (ISO 22301, NIS2, DORA): favour a documented link from impact ratings to MTPD and RTO, and a version history showing who approved what.
- IT disaster recovery is the priority: check the dependency model (applications, suppliers, sites) and whether the RTO is compared with what the IT recovery plan can deliver.
- Budget control: only two vendors publish prices; ask the others for the cost over three years, including implementation.
FAQ
What is BIA software?
BIA software runs the business impact analysis: it sends questionnaires to process owners, rates the impact of a disruption over time, derives recovery objectives (MTPD, RTO, RPO), records dependencies and feeds the results into continuity and recovery plans.
What is the best BIA software?
There is no single best product. An SME running its first BIA does not need what a bank with hundreds of processes needs. Compare how questionnaires reach process owners, how the RTO is derived, how dependencies are recorded, whether the BIA feeds the plans, hosting, and total cost over three years.
Which BIA tools calculate the RTO automatically?
Among the pages we checked, ServiceNow BCM calculates the RTO from the first non-tolerable impact rating, BCMmetrics derives RTO and RPO from the scores assigned, GlobalSuite consolidates MTPD, RTO and RPO per process from individual BIAs, and ResiPlan suggests the MTPD and RTO from the impact grid. Other vendors describe the RTO as set or captured without publishing a method.
How much does BIA software cost?
Most vendors do not publish prices. Public price points found on 1 November 2026: from €199 per month excl. VAT (annual billing) for ResiPlan's entry plan, and £24,000 per year for organisations of up to 250 employees for Riskonnect on the UK G-Cloud 15 price list, plus implementation.
Can I do a business impact analysis in Excel?
Yes, for a first BIA on a few processes. A spreadsheet becomes hard to maintain once you collect answers from many owners, keep versions and approvals, and need the results to update your plans.
Is BIA software required for ISO 22301, NIS2 or DORA?
No. ISO 22301 requires a business impact analysis (clause 8.2.2), and NIS2 and DORA require business continuity capabilities, but none of them requires a specific tool.
Sources
Pages checked on 1 November 2026.
- BCMmetrics: bcmmetrics.com (home page, pricing, BIA On-Demand and BCM Planner pages)
- Continuity2: continuity2.com/business-continuity-management-software/business-impact-analysis
- GlobalSuite: globalsuitesolutions.com/business-continuity; help centre (GlobalSuite Business Continuity); trust centre infrastructure overview (help.globalsuitesolutions.com)
- MAPSI: mapsi.fr/fr/logiciel-pca-pra
- Fusion: fusionrm.com/solutions/business-continuity-management; trust.fusionrm.com
- Riskonnect: riskonnect.com business continuity management page; G-Cloud 15 listing "Riskonnect Business Continuity & Resilience (formerly Castellan)" and its pricing document (January 2026) on applytosupply.digitalmarketplace.service.gov.uk
- Everbridge: everbridge.com/bcic-resilience; everbridge.com/bc-in-the-cloud-lp; G-Cloud 15 listing "Everbridge Business Continuity in the Cloud" (Softcat)
- Mitratech: mitratech.com/products/preparis; mitratech.com/client-success/hosting
- Noggin: noggin.io/solutions/business-continuity; Noggin library page "Business impact analyses"; Noggin business continuity software FAQs
- ServiceNow: ServiceNow product documentation, Business Continuity Management (BIA templates, calculating RTO and RPO, structured workflows for business impact analysis)
- Archer: archerirm.com/resilience-management; archerirm.com/business-resiliency; archerirm.com/pricing
- Quantivate: quantivate.com/business-continuity-software; ParaSolution: premiercontinuum.com/fr/parasolution
Spotted an outdated detail, or are you a vendor requesting a correction? Reach us through the contact page.