📈 economics

Dynamic Business Impact Analysis and Dependency-Aware Recovery Optimization for Mission-Critical Banking Operations

This study proposes a dynamic, dependency-aware framework for mission-critical banking operations that optimizes recovery prioritization by modeling cascading disruptions and balancing multiple impact criteria, resulting in significantly reduced recovery times, lower cumulative impact, and improved RTO/RPO compliance compared to traditional static methods.

Original authors: Sudipta Banik Chowdhury

Published 2026-11-02

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sudipta Banik Chowdhury

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

When a bank's digital systems falter, the consequences ripple far beyond a single frozen screen. Modern banking relies on a vast, invisible web where a failure in one corner—a power outage at a data center, a glitch in a third-party payment network, or a cyberattack on an authentication server—can knock out services for millions of customers simultaneously. For decades, banks have tried to prepare for these moments by creating static lists of importance. They would rank their services, deciding that "payment processing" is more critical than "fraud monitoring," and then plan to fix the most critical items first. However, this approach assumes that the world remains still during a crisis. It fails to account for the fact that the importance of a service changes by the minute depending on how many people are trying to use it, what other systems are broken, and how much data is at risk of being lost forever.

A new study by Sudipta Banik Chowdhury at Westcliff University challenges this old way of thinking. The research proposes a dynamic method for handling banking disasters, one that treats the bank not as a collection of isolated parts, but as a living, breathing network where every connection matters. Instead of relying on a fixed list, the study uses a computer model to simulate how disruptions spread and how the impact of a failure changes in real time. By mapping out exactly how services depend on one another, the researchers developed a way to decide which systems to fix first that adapts to the specific chaos of the moment. The goal is simple but vital: to keep the bank running and its customers safe when the unexpected happens, ensuring that the most damaging consequences are avoided even when resources are scarce.

The researchers built a sophisticated simulation to test their idea. They created a digital twin of a bank's operations, including core account services, payment processing, online banking, ATMs, and fraud monitoring. They then subjected this virtual bank to severe but realistic scenarios, such as a ransomware attack, a power failure at a data center, or a breakdown in the telecommunications network. In these simulations, the researchers watched how a failure in one area, like a shared database, would cascade through the system, causing delays and outages in seemingly unrelated services. They compared their new, dynamic approach against three traditional methods: fixing things based only on a pre-set importance list, fixing the quickest things first, and using a standard, unchanging business impact analysis.

The results of the simulation revealed a clear advantage for the dynamic method. In the traditional approaches, the bank's recovery teams often made decisions that seemed logical in isolation but caused greater harm to the system as a whole. For instance, rushing to restore a single application before fixing the shared network it relied on would leave that application useless, wasting precious time and resources. The new framework, which constantly updates the "impact score" of each service based on current conditions, managed to reduce the total time it took to recover the bank's operations to an average of 4.6 hours. More importantly, it significantly improved the bank's ability to meet its strict recovery goals. The dynamic method achieved an 82.9% compliance rate for recovery time objectives—meaning the services were back up within the required window much more often than with other methods—and an 88.6% compliance rate for data recovery, ensuring that very little financial data was lost.

One of the most striking findings was how the importance of different services shifted during a crisis. In the simulations, payment processing often became the most critical service to restore, but not because it was always the most important on a list. Its importance surged when transaction volumes were high or when it was blocked by a shared communication failure. Similarly, fraud monitoring, which might seem less urgent because it does not handle direct customer money, proved to be a high-risk area if left down for too long, as it could allow security breaches to go undetected. The study showed that a static ranking could not capture these nuances. Only by watching the network in real time could the recovery team see that fixing a shared communication link first would unlock the ability to restore multiple services at once, rather than trying to patch them one by one.

The research also highlighted the danger of ignoring the connections between different parts of the bank. The simulations demonstrated that a failure in a single shared resource, like a telecommunications provider or a cloud platform, could degrade the performance of online banking, ATM services, and customer authentication all at the same time. Traditional recovery plans often missed these "cascading" effects, focusing on the visible symptoms rather than the root cause. The new model, by mapping these dependencies, allowed the recovery team to prioritize the underlying resources that supported the most services. This approach meant that while some individual services might take slightly longer to fix, the overall system recovered faster and with less total damage to the bank's operations and its customers.

The study concludes that the way banks prepare for disasters needs to evolve from a static exercise into a continuous, adaptive process. The old method of creating a fixed list of priorities is insufficient for a world where technology is deeply interconnected and disruptions are complex. The dynamic framework offers a way to make smarter decisions under pressure, using real-time data to guide the allocation of limited recovery resources. While the findings are based on a simulated dataset rather than a real-world bank incident, the results provide a strong blueprint for how banks can build more resilient systems. By understanding the web of dependencies that hold their operations together, banks can move beyond simply reacting to failures and start managing the flow of recovery in a way that protects their most critical functions and their customers' trust.

Technical Summary: Dynamic Business Impact Analysis and Dependency-Aware Recovery Optimization for Mission-Critical Banking Operations

1. Problem Statement

Mission-critical banking operations (e.g., payment processing, core account services, online banking) do not function as isolated units but rely on complex, interconnected networks of applications, databases, infrastructure, personnel, and third-party providers. The central problem identified is that static Business Impact Analysis (BIA) fails to adequately represent the reality of these systems. Traditional approaches assign fixed criticality ratings to services, which do not account for:

Time-dependent conditions: Fluctuations in transaction volume, customer exposure, and incident duration.
Cascading disruptions: How a failure in a shared upstream dependency (e.g., telecommunications, authentication, or a cloud provider) degrades multiple downstream services simultaneously.
Resource constraints: The competition for limited recovery resources (teams, backup capacity, network switching) among conflicting priorities.

Consequently, recovery sequences based on fixed rankings or shortest recovery times may satisfy local service priorities while failing to minimize system-wide impact or violating Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).

2. Methodology

The study proposes a Dynamic Business Impact Analysis and Dependency-Aware Recovery Optimization Framework. The methodology is structured into six analytical stages, utilizing a synthetic simulation dataset calibrated to realistic banking conditions.

A. Dynamic Business Impact Analysis

Instead of a fixed score, the framework calculates a time-dependent impact score ( $I_{s,t}^{(q)}$ ) for each service $s$ at time $t$ under scenario $q$ . The score is a weighted aggregation of:

Structural Criticality ( $C_s$ ): Baseline importance.
Customer Exposure ( $U_{s,t}$ ): Number of affected customers/accounts.
Transaction Disruption ( $V_{s,t}$ ): Volume of failed or delayed transactions.
Financial Loss ( $F_{s,t}$ ): Estimated economic impact.
Data Loss ( $D_{s,t}$ ): Integrity and volume of lost data (RPO exposure).
Dependency Degradation ( $G_{s,t}$ ): Status of supporting resources.

B. Dependency-Network Modeling

The banking environment is modeled as a directed multilayer graph ( $G = (N, E)$ ).

Nodes ( $N$ ): Represent services, applications, databases, facilities, personnel, and third-party providers.
Edges ( $E$ ): Represent operational, technological, and informational dependencies with attributes for strength, redundancy, and failure propagation rules.
Logic: The model distinguishes between mandatory dependencies (failure causes outage) and substitutable dependencies (failure reduces capacity). It utilizes centrality measures to identify shared resources that could trigger cascading failures.

C. Scenario Simulation

The framework simulates severe but plausible disruption scenarios (e.g., ransomware, data-center power loss, payment-network interruption, third-party failure). Using Monte Carlo or discrete-event simulation, the model propagates failures through the dependency network, accounting for redundancy, manual workarounds, and recovery state transitions.

D. Recovery Optimization

A resource-constrained optimization model selects and sequences recovery actions to minimize a multi-criteria objective function ( $Z$ ):
$\text{min } Z = \sum \sum \sum [\alpha I_{s,t}^{(q)} + \beta RTOB_{s,t}^{(q)} + \gamma RPOB_{s,t}^{(q)} + \delta L_{s,t}^{(q)}] + \lambda \sum c_a x_a$
Where the model minimizes:

Cumulative dynamic impact.
RTO and RPO breach indicators.
Operational/financial loss.
Recovery costs ( $c_a$ ).

The model is subject to constraints regarding resource availability, dependency precedence (a dependency must be restored before the dependent service), and capacity limits.

3. Key Contributions

The paper outlines five principal contributions:

Dynamic Impact Formulation: A method to update service criticality in real-time based on transaction demand, customer exposure, and dependency status, moving beyond static rankings.
Integrated Dependency Modeling: The unification of BIA with a multilayer network representing the full spectrum of banking resources (people, process, technology, third parties).
Cascading Disruption Simulation: A model that captures shared-dependency failures and concurrent incidents, including partial service recovery and manual workarounds.
Resource-Constrained Optimization: A decision framework that balances cumulative impact, RTO/RPO compliance, and recovery costs under limited resource availability.
Comparative Evaluation: A structured validation comparing the proposed dynamic approach against three baselines: criticality-only prioritization, shortest-recovery-time prioritization, and static BIA.

4. Results and Performance

The study evaluated the framework against a synthetic dataset of 12,480 service-time interval observations across six banking services and five disruption scenarios.

Comparative Performance:
The proposed Dynamic Dependency-Aware Model outperformed all baselines:

Mean Recovery Time: Reduced to 4.6 hours (vs. 5.2–5.7 hours for baselines).
Cumulative Impact Score: Reduced to 0.47 (vs. 0.63–0.74 for baselines).
RTO Compliance: Increased to 82.9% (vs. 61.8%–68.7% for baselines).
RPO Compliance: Increased to 88.6% (vs. 70.8%–75.3% for baselines).

Key Observations:

Payment Processing showed the highest dynamic impact increase (41.7%) under concurrent telecommunications and payment-network disruptions, highlighting the failure of static models to capture peak-load dependencies.
Shared Dependencies: Restoring upstream shared resources (e.g., authentication, network links) before downstream applications yielded better system-level outcomes than prioritizing isolated services with short recovery times.
Data Continuity: The proposed model achieved higher RPO compliance by prioritizing data restoration and replication status alongside application availability.

5. Significance and Claims

The paper claims that the proposed framework provides a more reliable basis for system-level recovery decisions than fixed service rankings. Its significance lies in:

Operational Resilience: It aligns with supervisory guidance requiring banks to map interdependencies and test critical services against severe scenarios.
Decision Support: It offers a mechanism for incident commanders to visualize current impact, predicted RTO/RPO breaches, and recommended recovery sequences in real-time.
Strategic Planning: The framework supports impact-tolerance assessment, recovery playbook design, and infrastructure investment decisions by quantifying the value of redundancy and dependency management.

The author maintains a modest stance, noting that the results are derived from a synthetic dataset and that the model relies on expert-assigned weights and dependency strengths. They emphasize that future work requires validation against anonymized operational data from multiple institutions and the development of adaptive learning mechanisms to refine impact weights and propagation probabilities over time.