MELLORCATalk to Mellorca
Impact›Business Continuity
CPS-172 · Impact

When the Business Does Not Know Its Hourly Cost of Downtime — and Resilience Decisions Become Guesswork

A recovery target is difficult to defend when nobody has estimated what stops, how quickly consequences accumulate and which services must return first.

Mellorca Impact·Business Continuity·5 September 2026

The tolerated pain

Technology resilience is often discussed using generic labels such as critical, high priority or must always be available. Those labels are insufficient when investment decisions require a trade-off between recovery capability and cost.

Operational consequence

Without a business impact view, every system can appear equally important. Recovery sequencing becomes political, resilience spending is difficult to justify and teams may invest heavily in low-impact services while leaving true operational bottlenecks exposed.

How it becomes money

Estimate interruption by business function rather than applying a universal industry number.

downtime exposure = lost contribution + idle payroll + recovery cost + contractual or service impact + time-sensitive downstream effects

Not every component rises linearly by the hour. Some consequences appear only after thresholds. Model those thresholds explicitly.

NIST’s Business Impact Analysis guidance frames BIA around mission-essential functions and the assets that enable them. That is the right starting point for deciding which technology interruptions deserve the strongest recovery capability.

Commercial triggerIf leaders cannot explain what one hour, four hours and one day of interruption mean for a critical process, resilience investment is being prioritised without a business baseline.

Resolution

  1. Identify essential business functions.
  2. Map the systems, data, people and suppliers they depend on.
  3. Estimate impact over realistic interruption windows.
  4. Define tolerable recovery objectives from the business impact.
  5. Prioritise recovery architecture accordingly.
  6. Test assumptions during exercises and real incidents.

Bottom line

The purpose of downtime costing is not to manufacture a dramatic number. It is to make resilience decisions proportional to actual business consequence.

Source

NIST: Using Business Impact Analysis to Inform Risk Prioritization and Response.