BCM · Business Continuity Management
BCM-01 Business Continuity and Emergency Management System
Changed since C5:2020
Basic criterion
Added requirement to operate a business continuity and emergency management system according to ISO or BSI standards. Further specified the policies and procedures to be defined as part of this system.
Wording in C5:2020
Basic criterion
The top management (or a member of the top management) of the Cloud Service Provider is named as the process owner of business continuity and emergency management and is responsible for establishing the process within the company as well as ensuring compliance with the guidelines. They must ensure that sufficient resources are made available for an effective process.
People in management and other relevant leadership positions demonstrate leadership and commitment to this issue by encouraging employees to actively contribute to the effectiveness of continuity and emergency management.
Basic criterion
The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.
Supplementary information
The basic criterion can (but need not) be fulfilled with a certification of the BCM according to ISO/IEC 22301.
Policies and procedures for the cloud service's business continuity management, including strategy and guidelines, business impact analyses, and business continuity plans, are documented, communicated, and made available in accordance with SP-01 regarding the following aspects:
- Goals of the BCM;
- Roles and responsibilities, management commitment;
- Scoping of the BCM, identifying relevant business processes;
- Interfaces, in particular to Incident Management;
- Communication with relevant entities and competent authorities;
- Methodology;
- Consideration of Risk;
- Business Impact Analysis (BIA);
- Business Continuity Plan (BCP);
- Resource Planning (usually part of the BCP);
- Testing of Business Continuity Plans and regular updates to BCM documentation; and
- Continuous improvement of the Business Continuity Management.
Supplementary information
Please note: BCM can be integrated into enterprise risk management (ERM) to gain more efficiency and overcome management silos.
The top management (or a member of the top management) of the cloud service provider is named as the process owner of business continuity and emergency management and is responsible for establishing the process within the company as well as ensuring compliance with the guidelines. They ensure that sufficient resources are made available for an effective process.
Supplementary information
The top management responsibility can be delegated from top management to another individual as long this individual has the scope, responsibilities and capabilities to influence the cloud-service-wide business continuity strategy and activities just as the top management could do.
People in management and other relevant leadership positions demonstrate leadership and commitment to this issue by encouraging personnel to actively contribute to the effectiveness of continuity and emergency management.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources