Business continuity (BCM)

Business continuity is where you plan for disruption before it happens. You rate each process by how critical it is (a business impact analysis, or BIA), you keep a register of continuity plans, and you log the tests that prove those plans work. The page lives at /bcm and is called Business Continuity in the side nav. It supports ISO 22301 and ISO 27001 controls A.5.29 and A.5.30.

Before you start

• Module is off by default. An org admin must turn on Continuity (BCM) under Settings > Modules (in the Governance, risk & compliance group). Until then the /bcm route is blocked.
• Any signed-in member of the organization can add analyses, plans, and tests.
• Create your Processes first. A BIA is attached to a process, and only active processes appear in the picker. With no processes you get the message "No active processes to assess" and the dialog will not open.
• If you want to link a plan to its written procedure, upload that procedure in Documents first.

Assess a process (add a BIA)

Each process gets at most one impact analysis. Saving again for the same process updates the existing one.

1. Open Business Continuity and stay on the Impact Analysis tab.
2. Click Add BIA (top right).
3. In the Add Impact Analysis dialog, pick a Process. Processes that already have an analysis are hidden from the list.
4. Set Criticality: Vital, Critical, Important (the default), or Deferrable.
5. Fill the recovery targets, all in hours:
   • RTO (hours): how fast the process must be running again.
   • RPO (hours): how much data loss is tolerable.
   • MTPD (hours): the maximum tolerable period of disruption.
6. Add Impact notes (financial, legal, reputational, safety impact) and Dependencies (systems, suppliers, people, sites).
7. Click Add analysis.

The register sorts Vital first, then Critical, Important, and Deferrable. The stats bar counts Assessed processes and Vital + Critical. Use the pencil icon to edit an analysis and the trash icon to delete it. Deleting has no confirmation step, so click with care.

Create a continuity plan

1. Switch to the Plans & Tests tab. The header button changes to New Plan.
2. Click New Plan.
3. Fill the New Continuity Plan dialog:
   • Title (required), for example "Head-office loss-of-site plan".
   • Scope: sites, processes, and systems the plan covers.
   • Type: Business continuity, Disaster recovery, Crisis management, or Emergency response.
   • Status: Draft (default), Active, Under review, or Retired.
   • Owner: a member of the organization, or leave as Unassigned.
   • Linked document (optional): the written plan in Documents.
   • Next test: click Pick date to schedule the first test.
4. Click Create plan.

Set the status to Active once the plan is real. Only active plans are counted in the Active plans stat and only active plans can be overdue for testing.

Record a test

Plans are tested on a 12-month cadence. Recording a test moves the schedule forward automatically.

1. On the Plans & Tests tab, find the plan and click Record test.
2. In the Record Test dialog, set the Test date with Pick date (defaults to today).
3. Pick the Test type: Tabletop, Walkthrough, Simulation, or Full failover.
4. Pick the Outcome: Effective, Partially effective, Ineffective, or leave it as Not evaluated.
5. Write up Findings (what worked, what failed, gaps found) and Actions (follow-up actions and improvements).
6. Click Record test.

The app stamps the plan's last-tested date and sets the next test date to the test date plus 12 months. A confirmation message shows the new next test date. If a test surfaces a real weakness, raise a CAPA to fix it.

Review test history

1. On a plan row, click History.
2. The Test History dialog lists every test, newest first, with date, type, outcome, tester, findings, and actions.

Watch for overdue tests

A plan is overdue for testing when it is Active and either its next test date is in the past or it has never been given a next test date at all. Overdue plans show a red Test overdue tag on their row, and the stats bar counts them under Tests overdue.

Try it

• Enable Continuity (BCM) in Settings > Modules. Expected: Business Continuity appears in the side nav and /bcm loads.
• Click Add BIA with no processes in the org. Expected: a message says there are no active processes to assess and the dialog does not open.
• Add a BIA for a process with criticality Vital, RTO 4, RPO 1, MTPD 24. Expected: the row shows tags RTO 4h, RPO 1h, MTPD 24h and sorts to the top of the register.
• Click Add BIA again and open the Process list. Expected: the already-assessed process is not offered.
• Create a plan with status Active and no next test date. Expected: the row shows "Next test not scheduled" and a red Test overdue tag; Tests overdue in the stats bar increases by 1.
• Click Record test on that plan, type Tabletop, outcome Effective. Expected: a toast confirms the test and names a next test date 12 months out; the Test overdue tag disappears.
• Click History on the plan. Expected: the test appears with date, a Tabletop tag, and a green Effective tag.
• Set a plan's status to Retired via the pencil icon. Expected: it no longer counts toward Active plans or Tests overdue.

If something goes wrong

• The page is missing or blocked. The Continuity (BCM) module is off by default. Ask an org admin to enable it in Settings > Modules.
• "All active processes already have an impact analysis." Every active process is already assessed. Edit the existing BIA with the pencil icon instead of adding a new one.
• The Process field is locked while editing. That is by design. A BIA belongs to one process. Delete it and create a new one if you assessed the wrong process.
• A plan never shows as overdue. Only Active plans are tracked. Draft, Under review, and Retired plans are ignored by the overdue check.
• Create plan does nothing. Title is required. The button will not save an empty title.
• The linked document is not in the list. The picker shows up to 500 documents by title. Add the document in Documents first, then click Refresh on the BCM page.
• RTO, RPO, or MTPD did not save. These fields accept whole numbers of hours only. Text or decimals are dropped.