Business Continuity Management—Identifying Relevant Processes for a Reference Model

Abstract

Currently, a standardized process reference model specifically tailored for the business continuity management system (BCMS) is absent. Moreover, BCMS processes have not been a primary focus of ongoing research endeavors. This paper aims to fill this research gap by presenting findings from a process mapping study concerning BCMS processes within the most prominent and widely acknowledged standards for business continuity management, alongside insights gleaned from expert interviews. The authors propose a collection of BCMS processes that should comprise a BCMS process reference model intended for implementation at a maturity level tailored to individual organizational needs. It aims to strengthen the resilience of organizations to cyber threats and to optimize the processes for effective management within the disaster management cycle. The study identifies and maps the necessary processes required to build a comprehensive BCMS model. These processes include, among others, risk assessment, business impact analysis, the development of BC strategies and solutions, the creation of BC plans and procedures, incident and emergency management, and periodic reviews and exercises. The relevance of these processes was validated through expert interviews, making a clear distinction between core, management, and support processes.