Business continuity management (BCM): a guide for resilient organisations

Key takeaways

• Business continuity management (BCM) protects the entire business — not just IT. It aims to keep critical business processes going despite disruptions. Unlike pure information security, which tries to prevent attacks, BCM focuses on the ability to act once an emergency has already happened. Disaster recovery, in turn, is only one part of continuity management.
• NIS2, DORA (applicable since 17 January 2025) and the German KRITIS umbrella act (in force since 17 March 2026) explicitly require BCM measures. Regulatory requirements provide for heavy penalties in case of non-compliance. Organisations in scope must be able to prove that they can keep operating in a crisis.
• Effective BCM can reduce the cost of outages, protects reputation, improves compliance and increases organisational resilience. It also strengthens the negotiating position with customers and insurers.
• Business impact analysis, risk analysis, emergency and recovery plans and regular exercises are core building blocks of a BCMS according to ISO 22301 or BSI Standard 200-4. BCM is a continuous process, not a one-off project.
• Further down we describe a concrete, pragmatic way to introduce it — including a pointer to the BCM software from NICA, which gives structure to building and running a BCMS: documents are generated from one shared data basis.

BCM and continuity management in brief

Continuity management is the systematic approach to keeping vital business processes running even during cyberattacks, building outages or supply shortages. It combines organisational, technical and personnel measures in a framework that goes beyond preventive IT security and pure disaster recovery.

• Business continuity focuses on keeping processes running and securing business operations. Information security (e.g. according to ISO 27001) primarily aims to prevent attacks — BCM takes over where prevention alone is not enough.
• Real events show why it is needed: the 2021 floods in the Ahr valley hit numerous businesses hard, and many had to close for months. Supply chain problems since 2020 and ransomware waves between 2023 and 2026 show that many losses cannot be completely avoided — but BCM makes them manageable.
• BCM is not only relevant for large corporations and critical infrastructure operators. SMEs with critical customer relationships — such as automotive suppliers, IT service providers or logistics companies — benefit directly as well. Preventive measures are needed to minimise potential risks, but real resilience also requires a well-thought-out continuity plan.

BCMS — from concept to management system

The idea of business continuity becomes a business continuity management system with defined roles, processes and documents. A BCMS is not a static manual but a living management system that is maintained and improved continually.

• A BCMS follows the management system approach of ISO 22301 with the PDCA cycle (plan–do–check–act). This includes annual reviews, measurable key figures and management reviews. ISO 22301 describes the requirements for such a BCMS.
• Typical artefacts of a BCMS are: BCM policy, scope, business impact analysis, risk analysis, emergency and recovery plans, exercise records and improvement actions.
• The BCMS can be integrated seamlessly with existing systems: ISO 27001 supports BCM with information security controls, quality management according to ISO 9001 provides process structures, and the BSI IT-Grundschutz modules provide a technical basis. The common structure of the ISO standards makes integration easier.
• Think of the relationship like this: corporate strategy defines goals, risk management assesses threats, the BCMS derives concrete plans and measures from them, and at the operational level the emergency and recovery processes take effect.

Key terms: BCM, BCP, BIA, IT emergency management and disaster recovery

Many terms around business continuity cause confusion. Here the most important ones are explained in context — as a compact glossary:

• Business continuity management (BCM): The overarching management process that steers, monitors and improves all continuity measures. It covers the entire planning, implementation and review.
• Business continuity plan (BCP): The concrete document with emergency and recovery plans, including checklists, contact lists and flow charts. Emergency and recovery plans set out instructions for a crisis.
• Business impact analysis (BIA): The BIA identifies critical business processes and their downtimes. It assesses the business impact of interruptions and sets the maximum tolerable period of disruption (MTPD) and, from it, the recovery time objective (RTO).
• IT emergency management and disaster recovery: IT emergency management organises the technical restoration of IT services and IT systems. Disaster recovery focuses on IT infrastructure, data and applications. Both are part of the overarching BCM but only cover the technical side. ITSCM (IT service continuity management) is the ITIL term for this area.

BCM vs. IT emergency management and disaster recovery

The key difference: BCM is oriented to business processes, IT emergency management and disaster recovery are oriented to systems.

• Example: if a retailer’s ERP system fails, BCM prioritises the business processes of ordering, picking and shipping by their business importance. IT emergency management then derives the RTO and RPO for servers, databases and equipment from that. Without this business prioritisation by BCM, the order of recovery and the procedures would often be misdirected.
• Disaster recovery typically covers backup, replication, an alternate data centre and recovery tests. DR concentrates on restoring the IT infrastructure. Redundant systems ensure the availability of important IT infrastructure. Without overarching BCM, however, the link to business priorities is missing — DR is one part of business continuity management, not a substitute for it.
• NIS2 (opens in a new tab) explicitly names business continuity — such as backup management and disaster recovery — and crisis management. Pure DR does not cover that. BCM can go beyond DR and cover other risks such as staff shortages, fire or supplier failure.

NICA

Why business continuity management is indispensable today

Between 2023 and 2026, risk trends have become noticeably sharper: increasing cyberattacks, energy crises, geopolitical tensions, extreme weather and supply chain disruptions challenge organisations at every level.

• Studies show the costs: research by Splunk (Cisco) and Oxford Economics (opens in a new tab) puts the consequences of unplanned outages for the 2,000 largest companies worldwide at an average of around 95 million US dollars in lost revenue per year; one minute of downtime costs them around 15,000 US dollars on average.
• Regulations such as NIS2, DORA, the KRITIS umbrella act and sector-specific standards make BCM mandatory for the organisations in scope. NIS2 requires BCM as part of risk management. Those who do not meet the requirements risk serious losses — not only financial but also reputational.
• Economic benefits of effective BCM: lower downtime costs, faster resumption of business, a better negotiating position with insurers and higher customer satisfaction. Effective BCM can prevent insolvencies.
• BCM is the foundation of real resilience — the ability not only to survive crises but to emerge stronger and to stay able to act over the long term.

Regulatory framework: NIS2, DORA, the KRITIS umbrella act and IT-Grundschutz

Since 2024 in the EU and since the end of 2025 in Germany, a much stricter legal framework for continuity management applies, covering far more organisations than before.

• NIS2: The directive covers sectors such as energy, transport, healthcare and digital services. Article 21 explicitly requires backup management, disaster recovery and business continuity as risk management measures. In Germany this has been implemented in the BSI Act since 6 December 2025. In practice this means business continuity plans for which a business impact analysis is the usual basis.
• DORA: Applicable to financial entities since 17 January 2025; critical ICT third-party service providers are subject to their own oversight. DORA (opens in a new tab) requires ICT resilience, documented ICT business continuity policies, tested continuity and recovery plans and regular crisis management.
• KRITIS umbrella act (KRITIS-Dachgesetz): In force since 17 March 2026 (opens in a new tab), it strengthens the physical and organisational resilience of critical facilities in Germany. Operators must carry out a risk analysis at least every four years, record their resilience measures in a resilience plan and prove them on request, for example through audits. BCM, emergency management and crisis organisation are considered together.
• BSI IT-Grundschutz: The IT-Grundschutz modules are interlinked with BCM. BSI Standard 200-4 builds on this methodology and offers practical guidance for implementation.
• In a later section we show how a solution such as the BCM software from NICA supports companies in providing evidence to supervisory authorities, customers and auditors.

BCM standards: ISO 22301 and BSI Standard 200-4

When setting up BCM, organisations should follow established standards so that they are ready for audits and reviews.

• ISO 22301 is a globally recognised BCM standard and, in its 2019 edition, the international reference standard for certifiable business continuity management. DIN EN ISO 22301 is the German edition. Core requirements: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement.
• BSI Standard 200-4 was published in 2023 (opens in a new tab) and provides a BCM framework that closely links BCM with information security and emergency management. It works with a three-level model (reactive BCMS, build-up BCMS, standard BCMS) and is particularly practical.
• Common ground: Both follow the PDCA cycle and require business impact analysis, risk analysis, strategies, plans and exercises.
• Differences: ISO 22301 is an internationally recognised BCM standard that can be certified against. BSI 200-4 is not geared to certification, but it is methodically very detailed and closely linked with IT-Grundschutz. The standard BCMS is designed to be compatible with ISO 22301.
• Organisations can combine both worlds: use the BSI methodology internally and get certified externally to ISO 22301 — a pragmatic approach that balances effort and benefit.

Core building blocks of effective business continuity management

The following building blocks form the BCM life cycle and can be implemented in a structured way with software support.

• Business impact analysis (BIA): In workshops with business units, critical business processes, dependencies (IT, buildings, staff, suppliers), maximum tolerable periods of disruption (MTPD), recovery time objectives (RTO) and the tolerable data loss (RPO) are determined. The results are documented in a structured way. Risk assessments help to evaluate threats to critical business processes.
• Risk analysis: Typical threats — power failure, cyberattack, fire, pandemic, supplier failure — are assessed per process for likelihood and impact and combined into a priority list. BCM is based on analysing risks and developing emergency plans.
• Continuity strategies: Concrete strategies are derived from the BIA and risk analysis: alternate workplaces, a second data centre, alternative suppliers or manual emergency processes. Alternative sites matter in case the headquarters fails. The strategies are organised into scenarios.
• Emergency and recovery plans: These plans should be clear, short and usable in an emergency — with checklists, contact lists and flow charts. Crisis communication and clear roles are decisive in BCM. The plans contain both organisational steps and technical disaster recovery measures.
• Training and exercises: Formats range from situation briefings and tabletop exercises to technical failover tests and crisis team exercises. A retailer could, for example, run through a simulated ERP outage every quarter. Regular tests and exercises are important to check emergency plans. Results are documented and turned into improvement actions.

NICA

Start pragmatically or build for audit? The BCM approach for SMEs and corporations

Not every company needs a full BCMS according to ISO 22301 straight away. Still, every organisation benefits from structured continuity management that matches its maturity.

• A lean start for SMEs: Focus on a few critical processes, a simple BIA, basic scenarios (IT failure, loss of a building, staff shortage) and simple emergency plans. Documentation in central templates or easy-to-use BCM software is enough to start.
• An audit-ready BCMS: Makes sense under regulatory pressure (NIS2, KRITIS), when key customers require it or for internal governance. How long the build-up takes depends mainly on size, starting point and available resources.
• The BSI level model: BSI Standard 200-4 explicitly provides for several levels — from the reactive through the build-up to the standard BCMS. An energy supplier under KRITIS will aim for the standard level; a mid-sized manufacturer can start with the reactive level and grow step by step.

NICA

From theory to practice: the BCM process according to PDCA

The PDCA cycle (plan–do–check–act) is the backbone of every business continuity management system. It is found in ISO 22301 as well as in BSI Standard 200-4.

• Plan: Set the context and goal, define the scope, write the BCM policy, carry out the BIA and risk analysis, develop strategies.
• Do: Create emergency and recovery plans, implement technical and organisational measures, fill roles, train staff. An IT service provider could, for example, configure alternate data centres and name an emergency team in this phase.
• Check: Carry out internal audits, hold management reviews, evaluate key figures (e.g. time to recovery in tests, number of weaknesses identified). Lessons learned from real incidents and exercises feed in.
• Act: Derive concrete improvement actions from the results, update plans and make the BCMS more mature step by step.

NICA

Software-supported BCM: efficiency gains with the BCM solution from NICA

Manual BCM in scattered individual documents without versioning is inefficient and risky. A common audit finding: plans exist but are neither up to date nor tested. A specialised BCM software solution helps to tackle these problems systematically.

• The BCM solution from NICA manages processes, BIA results, risks, measures and emergency plans centrally in one integrated system. All relevant data is in one place instead of being scattered across dozens of files.
• The tool structures the business impact analysis and risk analysis: standardised questionnaires, assessment logic and automatic prioritisation reduce errors and inconsistencies. The analysis becomes reproducible and traceable.
• When providing evidence to supervisory authorities, customers and auditors, the software supports you with traceable documentation including versions and approvals, standards coverage for ISO 22301 and BSI Standard 200-4, and PDF export.
• NICA BCM suits SMEs (guided start, templates from the library) as well as the complex requirements of regulated organisations — such as organisations affected by NIS2 or critical infrastructure operators.
• Example: A mid-sized manufacturer moves its emergency management from scattered individual documents into NICA BCM. BIA results, risk assessments and emergency plans are then held centrally and versioned; the company uses this to prepare an ISO 22301 audit and can answer questions from customers and supervisory authorities with solid evidence.

NICA

FAQ on business continuity management

The following frequently asked questions cover practical details on effort, responsibilities and first steps that the main text only touched on.