A fire, a cyberattack, the failure of an important supplier, or a pandemic: some events hit a company so hard that normal operations are no longer possible. BCM prepares for this by clarifying in advance which processes are indispensable, how long they may be down, and what emergency operations look like. It affects the entire company, not just IT.
The international reference framework is the ISO 22301 standard for business continuity management systems; in Germany, the BSI Standard 200-4 also describes the approach. NIS2 also explicitly names business continuity, for example through backup management and disaster recovery, as well as crisis management as part of the risk management measures.
How does BCM work?
- Business impact analysis: For each business process, the consequences of an outage over time are determined, along with the resources it needs, such as staff, premises, IT, and suppliers.
- Risk assessment: The threats that could cause these resources to fail are examined, see IT Risk Analysis.
- Strategies and plans: Emergency operation and restart plans are created for critical processes, for example alternative workplaces, manual fallback procedures, or alternative suppliers. For IT, disaster recovery handles the restoration.
- Crisis organization: A crisis team with clear roles, decision-making authority, and communication channels is defined.
- Exercises and improvement: Plans are regularly practiced, evaluated, and adjusted.
Typical examples
- A manufacturing company defines how orders are processed manually during an ERP system outage lasting several days.
- A service provider ensures that employees can continue working from home if the office building becomes unavailable.
- A retail company protects itself against a critical supplier by securing a second source of supply.
What companies should keep in mind
- Start with the truly critical processes instead of looking at everything at once.
- Keep emergency plans short and usable in an emergency, including in printed or offline form.
- Include dependencies on IT service providers and cloud services, and check contractual commitments such as SLAs.
- Take exercises seriously, because only they show whether plans work.
How it differs
Disaster recovery is part of BCM and relates to IT. BCM also covers staff, buildings, supply chains, and communication.
This entry is a general overview and does not replace legal advice.
View strategy and consulting