BCM · Business Continuity Management
BCM-03 Business Continuity Plans
Changed since C5:2020
Basic criterion
Restricted scope to business continuity plans.
Removed requirement that business continuity plans are based on established standards. Instead they are required to be documented in a consistent manner, and in accordance with applicable policies and instructions.
Extended aspects to covered by the business continuity plans by consistency over all locations, zones, regions and partitions.
Added requirement for the review of the business continuity plans.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
Based on the business impact analysis, a single framework for operational continuity and business plan planning will be implemented, documented and enforced to ensure that all plans are consistent. Planning is based on established standards, which are documented in a "Statement of Applicability".
Business continuity plans and contingency plans take the following aspects into account:
- Defined purpose and scope with consideration of the relevant dependencies;
- Accessibility and comprehensibility of the plans for persons who are to act accordingly;
- Ownership by at least one designated person responsible for review, updating and approval;
- Defined communication channels, roles and responsibilities including notification of the customer;
- Recovery procedures, manual interim solutions and reference information (taking into account prioritisation in the recovery of cloud infrastructure components and services and alignment with customers);
- Methods for putting the plans into effect;
- Continuous process improvement; and
- Interfaces to Security Incident Management.
Supplementary information on all sub-criteria
Although different partitions do not share a common IAM (and hence no common personnel for BCM), business continuity plans may be shared between different partitions since the same cloud services are provided.
Basic criterion
Based on the results of the business impact analysis, business continuity plans are documented in a consistent manner, and in accordance with applicable policies and procedures.
Business continuity plans take the following aspects into account:
- Defined purpose and scope with consideration of the relevant dependencies;
- Accessibility and comprehensibility of the plans for persons who are to act accordingly;
- Ownership by at least one designated person responsible for review, updating and approval;
- Defined communication channels, roles and responsibilities including notification of the customer;
- Recovery procedures, manual interim solutions and reference information (taking into account prioritisation in the recovery of cloud hardware objects and services and alignment with customers);
- Methods for putting the plans into effect;
- Continuous process improvement;
- Consistency over all locations, zones, regions and partitions; and
- Interfaces to Security Incident Management.
The business continuity plans are reviewed at regular intervals, at least once a year, or after significant organisational or environment-related changes.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that the results of their business impact analysis are sufficiently considered when planning the operational continuity and the business plan in order to provide for the effects of a failure of the cloud service or cloud service provider.
Cloud service customers ensure with suitable controls that the availability of the cloud service, its recovery time according to the BCM plan and the data loss of the cloud service are consistent with their own availability requirements and tolerable data loss.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources