Business continuity management (BCM): a guide to terms, process and standards
What is BCM?
Business continuity management (BCM) is the management process that identifies critical business processes and protects them so that they survive a disruption. BCM is not meant to prevent every incident. It is meant to preserve the ability to act and to ensure that defined recovery times are met.
The key terms
BIA (business impact analysis)
Identifies the critical processes and the consequences of their disruption over time. It is the basis of every BCM strategy.
RTO (recovery time objective)
The maximum tolerable time until a process is restored after a disruption.
RPO (recovery point objective)
The maximum tolerable data loss, measured as the period before the disruption.
MTPD / MAO
The maximum tolerable period of disruption, beyond which an outage threatens the organisation’s existence.
BCP / continuity plan
The business continuity plan describes concretely how operations are maintained and restarted in a crisis.
Everything else builds on two elements: the business impact analysis prioritises your processes, RTO and RPO turn that priority into concrete target times.
The BCM lifecycle
BCM is a continuous cycle (PDCA principle):
- Context and policy: define scope, objectives and responsibilities.
- Analysis: carry out the business impact analysis and the risk assessment.
- Strategy: choose measures for continuity and recovery.
- Implementation: write the continuity and recovery plans (BCP).
- Exercise and test: test the plans regularly, for example with tabletop exercises.
- Evaluation and improvement: evaluate the findings and run the cycle again.
Standards: ISO 22301 and national guidance
ISO 22301 is the international standard for business continuity management systems (BCMS) and the only BCM standard that can be certified. Details are in the article ISO 22301. National guidance such as NIST SP 800-34 (IT contingency planning) or the German BSI Standard 200-4 provides step-by-step guides for building a BCM. All of them explicitly require that the plans are exercised and tested regularly.
BCM and compliance
BCM is also anchored in regulation. NIS2 Art. 21 requires business continuity and crisis management. DORA requires business continuity and contingency plans and that they are tested.
The underestimated obligation: test the plans
A plan that has never been exercised fails in a real incident. How to test BCM plans efficiently and in an auditable way is explained under BCM testing with the tabletop exercise. What belongs in the plan you test is covered by the article on the incident response plan.
Frequently asked questions
What is business continuity management?
BCM is the management process by which an organisation maintains or quickly restores its critical services during disruptions (such as cyber attacks, outages or natural events). The authoritative standard is ISO 22301; NIST SP 800-34 is a widely used guide for IT contingency planning.
What is the difference between RTO and RPO?
The RTO (recovery time objective) is the target time until a process runs again after a disruption. The RPO (recovery point objective) is the maximum tolerable data loss, that is how much data currency may be lost in a real incident.
Do BCM plans have to be tested?
Yes. ISO 22301 requires an exercise and testing programme. NIS2 requires measures for business continuity and procedures to assess their effectiveness (Art. 21(2)(c) and (f)). DORA requires ICT business continuity plans to be tested at least yearly (Art. 11(6)). Tabletop exercises are an efficient way to do that, and they deliver auditable evidence.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.