BCM · Business Continuity Management
BCM-04 Testing Business Continuity
Changed since C5:2020
Basic criterion
Restricted scope of the first requirement to business continuity plans.
Additional criterion
Added requirements regarding the information cloud service customers receive about the tests and exercises.
Added requirement for the existing alarm and notification plan to be reviewed after a completed exercise.
Wording in C5:2020
Basic criterion
The business impact analysis, business continuity plans and contingency plans are reviewed, updated and tested on a regular basis (at least annually) or after significant organisational or environmental changes. Tests involve affected customers (tenants) and relevant third parties. The tests are documented and results are taken into account for future operational continuity measures.
Additional criterion
In addition to the tests, exercises are also carried out which, among other things, have resulted in scenarios from security incidents that have already occurred in the past.
Basic criterion
Business continuity plans are tested on a regular basis (at least annually) or after significant organisational or environmental changes. Tests involve affected cloud service customers and relevant third parties (e.g. service organisations).
Supplementary information
Also applies to 01AC
Tests are primarily conducted at the operational level and are aimed at operational target groups. Tests include e.g.:
- Test of technical precautionary safeguards;
- Functional tests; and
- Plan review.
Exercises also take place on a tactical and strategic level. These include e.g.:
- Plan meeting;
- Personnel exercise;
- Command post exercise;
- Communication and alerting exercise;
- Simulation of scenarios; and
- Emergency or full exercise.
Relevant third parties are in particular service organisations of the cloud service provider who contribute to the development or operation of the cloud service (cf. basic criteria SSO-02 and SSO-06). A cloud service customer is affected (in the sense of this criterion) if the test or excercise leads to a service downgrade outside of the level defined in the SLA or if the effectiveness of the plans can only be tested if the cloud service customer has to take action.
The tests are documented and results are taken into account to review the business continuity plans and for future business continuity measures.
Additional criterion
BCM-04.01AC
Additional, complementingIn addition to the tests, exercises are also carried out which, among other things, have resulted in scenarios from security incidents that have already occurred in the past.
Supplementary information
Also applies to 01B
Tests are primarily conducted at the operational level and are aimed at operational target groups. Tests include e.g.:
- Test of technical precautionary safeguards;
- Functional tests; and
- Plan review.
Exercises also take place on a tactical and strategic level. These include e.g.:
- Plan meeting;
- Personnel exercise;
- Command post exercise;
- Communication and alerting exercise;
- Simulation of scenarios; and
- Emergency or full exercise.
Relevant third parties are in particular service organisations of the cloud service provider who contribute to the development or operation of the cloud service (cf. basic criteria SSO-02 and SSO-06). A cloud service customer is affected (in the sense of this criterion) if the test or excercise leads to a service downgrade outside of the level defined in the SLA or if the effectiveness of the plans can only be tested if the cloud service customer has to take action.
BCM-04.02AC
Additional, complementingThe cloud service provider has procedures in place to ensure that cloud service customers are timely informed about planned activities related to business continuity tests and exercises that could affect the information security of the cloud service (e.g. regarding its availability). This information includes the scheduled time frame for the operations as well as a description of the work to be carried out.
BCM-04.03AC
Additional, complementingThe cloud service provider provides cloud service customers an assessment of the potential impacts of those tests and excercises concerning the information security of the cloud service and with details for contacting the cloud service provider.
BCM-04.04AC
Additional, complementingAfter a completed exercise, the existing alarm and notification plan is reviewed and (if needed) adapted.
Supplementary information
The term 'alarm and notification plan' refers to the documented procedure for alerting responsible personnel and stakeholders in case of incidents or disruptions.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that measures to prevent the impact of a cloud service or cloud service provider outage are regularly reviewed, updated, tested and exercised. The cloud service provider is involved in the tests and exercises in accordance with the contractual agreements.
Cloud service customers ensure with suitable controls that the results of the cloud service provider's BCM tests and exercises are incorporated into their own BCM and that they are fully appreciated with regard to ensuring the customer's operational continuity.
In tests and exercises that involve the customer and therefore require own measures on the customer side, cloud service customers ensure that the appropriate measures for coping with the scenario are practiced and tested by means of suitable BCM controls.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources