C5 Field Guideunofficial

BCM · Business Continuity Management

BCM-02 Business Impact Analysis

2 sub-criteria, with customer criteria

Changed since C5:2020

Basic criterion

Specified which data types the criterion applies to.

Rephrased the first two sentences of the criterion to more explicitly state that it centers around the performance of a BIA.

Added requirement regarding the review of the BIA.

Bullet points are now sorted to ease discussions about specific list items.

Wording in C5:2020

Basic criterion

Policies and instructions to determine the impact of any malfunction to the cloud service or enterprise are documented, communicated and made available in accordance with SP-01. The following aspects are considered as minimum:

  • Possible scenarios based on a risk analysis;
  • Identification of critical products and services
  • Identify dependencies, including processes (including resources required), applications, business partners and third parties;
  • Capture threats to critical products and services;
  • Identification of effects resulting from planned and unplanned malfunctions and changes over time;
  • Determination of the maximum acceptable duration of malfunctions;
  • Identification of restoration priorities;
  • Determination of time targets for the resumption of critical products and services within the maximum acceptable time period (RTO);
  • Determination of time targets for the maximum reasonable period during which data can be lost and not recovered (RPO); and
  • Estimation of the resources needed for resumption.

All changes since C5:2020

Basic criterion

BCM-02.01B

The cloud service provider performs a Business Impact Analysis (BIA). In this BIA, the cloud service provider analyses the impact of disrupting activities to its organisation with respect the development and operations of the cloud service in accordance with applicable policies and procedures with at least the following aspects:

  1. Possible scenarios based on a risk assessment that includes cybersecurity risks;
  2. Identification of critical products and services;
  3. Identification of dependencies, including processes (including resources required), applications, business partners and third parties;
  4. Capturing threats to critical products and services;
  5. Identification of effects resulting from planned and unplanned outages, service degradations and changes over time;
  6. Determination of the maximum tolerable period of downtime and service degregation;
  7. Identification of restoration priorities;
  8. Determination of time targets for the resumption of critical products and services within the maximum acceptable time period (i.e. RTO);
  9. Determination of time targets for the maximum reasonable period during which cloud service derived data, cloud service provider data, account data and, if its processing is contractually agreed upon, cloud service customer data can be lost and not recovered (i.e. RPO); and
  10. Estimation of the resources needed for resumption.
Supplementary information

Scenarios to be considered according to the basic criterion are, for example, the loss of personnel, buildings, infrastructure and service providers.

BCM-02.02B

The business impact analysis adheres to the applicable policies and procedures and is reviewed at regular intervals, at least once a year, or after significant organisational or environment-related changes.

Complementary customer criteria

What cloud service customers implement on their side.

Cloud service customers ensure with suitable controls that the scenarios for a failure of the cloud service or the cloud service provider are sufficiently considered in the context of their business impact analysis.

All customer criteria in one place

Criteria that reference BCM-02

BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources