The organization should establish a formal evaluation process for determining continuity and recovery priorities and...

 One of the purposes of the business impact analysis (BIA) is to determine the minimal acceptable outage (MAO) for each critical function or process of the organization. The MAO is the maximum amount of time that a function or process can be disrupted before it causes unacceptable consequences for the organization. The MAO is used to define the recovery time objective (RTO) and the recovery point objective (RPO) for each function or process. The RTO is the time within which a function or process must be restored after a disruption, and the RPO is the point in time to which the data and information must be recovered. The BIA helps the organization to prioritize its recovery efforts and allocate the necessary resources for business continuity. References: ISO 22301 Auditing eBook, page 38; ISO 22301:2019 standard, clause 8.2.2