# BCM-01 Business Continuity and Emergency Management System

- Domain: BCM – Business Continuity Management
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/bcm-01/

## Basic criterion

### BCM-01.01B

The cloud service provider operates a business continuity and emergency management system in accordance with ISO 22301 and/or BSI 200-4.

**Supplementary information:**

The basic criterion can (but need not) be fulfilled with a certification of the BCM according to ISO/IEC 22301.

### BCM-01.02B

Policies and procedures for the cloud service's business continuity management, including strategy and guidelines, business impact analyses, and business continuity plans, are documented, communicated, and made available in accordance with SP-01 regarding the following aspects:

1. Goals of the BCM;
2. Roles and responsibilities, management commitment;
3. Scoping of the BCM, identifying relevant business processes;
4. Interfaces, in particular to Incident Management;
5. Communication with relevant entities and competent authorities;
6. Methodology;
7. Consideration of Risk;
8. Business Impact Analysis (BIA);
9. Business Continuity Plan (BCP);
10. Resource Planning (usually part of the BCP);
11. Testing of Business Continuity Plans and regular updates to BCM documentation; and
12. Continuous improvement of the Business Continuity Management.

**Supplementary information:**

Please note: BCM can be integrated into enterprise risk management (ERM) to gain more efficiency and overcome management silos.

### BCM-01.03B

The top management (or a member of the top management) of the cloud service provider is named as the process owner of business continuity and emergency management and is responsible for establishing the process within the company as well as ensuring compliance with the guidelines. They ensure that sufficient resources are made available for an effective process.

**Supplementary information:**

The top management responsibility can be delegated from top management to another individual as long this individual has the scope, responsibilities and capabilities to influence the cloud-service-wide business continuity strategy and activities just as the top management could do.

### BCM-01.04B

People in management and other relevant leadership positions demonstrate leadership and commitment to this issue by encouraging personnel to actively contribute to the effectiveness of continuity and emergency management.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added requirement to operate a business continuity and emergency management system according to ISO or BSI standards. Further specified the policies and procedures to be defined as part of this system.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.