Business Continuity Management (BCM)

What is BCM (business continuity management)?

Business continuity management is a process that helps organizations ensure that their critical business functions will continue to operate in the event of an unexpected disruption.

The goal of business continuity management is to minimize the impact of disruptions on an organization and help it resume normal operations as quickly as possible.

A BCMS (business continuity management system) aligned to ISO 22301 is the best way to ensure effective business continuity.

Find out more about ISO 22301 >>

Why is BCM important?

BCM is about identifying potential threats early and planning for how business operations could be impacted.

An effective BCM program helps an organization maintain minimum acceptable operations during a disaster, preserving corporate reputation and revenue. It may also improve insurance rates and provide new contract opportunities.

The current cyber threat landscape has made business leaders more aware of the risks of cyber attacks and the importance of being able to respond to and recover from such attacks.

Effective BCM can protect organizations from widespread business disruptions, such as cyber attacks, industrial action, and natural disasters.

How BCM can meet regulatory requirements

A growing body of legislation also requires organizations in essential areas to demonstrate a degree of organizational resilience; implementing effective business continuity measurements would be a good start. 

The NIST CSF (Cybersecurity Framework)

In order to comply with the NIST CSF (Cybersecurity Framework), organizations must first consider the five core funcations of the framework, all of which can be obtained by implementing strong BCM:

1. Identify potential cybersecurity risks to your information assets
2. Protect yourself against these risks by developing and implementing safeguards
3. Detect any irregular activity to determine if breaches have occurred
4. Respond to any detected breaches to contain their impact
5. Recover from these breaches by restoring any undermined assets

Learn more about NIST CSF >>

The EU's Network and Information Systems Directive 2018

Organizations offering essential services need to implement incident response capabilities in line with the requirements of the EU's Network and Information Systems Directive 2018 (NIS Regulations). Digital service providers (DSPs) within scope have the explicit requirement to put business continuity measures in place. Although not an explicit requirement for operators of essential services (OES), we strongly encourage them to consider implementing BCM measures; such measures would provide a well-defined structure for building incident response measures and effectively managing business interruptions.

Learn more about the EU's Network and Information Systems Directive 2018 >>

The BCM lifecycle

Effective BCM involves:

• Identifying critical activities
• Performing a BIA
• Performing a risk assessment
• Designing and implementing a BCP
• Testing and evaluating performance
• Putting a continual improvement process in place

Business continuity planning

Business continuity planning involves developing, testing and improving plans and procedures to enable an organisation to continue operating during a disaster and quickly return to normal operations.

The BCP is the key element of a BCMS, and ISO 22301 provides guidance on how to develop it.

Disaster recovery planning

Disaster recovery planning prioritises fully recovering and returning to full functionality in the event of an incident, whereas BCM focuses on preserving an organisation’s ability to function. Having said that, there is still a clear overlap, and disaster recovery does fit within an organisation’s business continuity framework.

Disaster recovery plans are often relatively technical and focus on the recovery of specific operations, functions, sites, services or applications. The BCP might contain or refer to a number of disaster recovery plans.