A Monday, 07:48 a.m. The IT of a large public utility completely collapses — the cause: a ransomware attack. No power grid monitoring, no customer communication, no billing. In the meeting room: crisis mode. Emergency plans are being sought. It's too late.
What would have helped? An active, system-supported BCMS.
What is a BCMS?
A business continuity management system (BCMS) is a systematic, standards-based approach to maintaining operability in exceptional situations. It aims to continue critical business processes even in the event of a crisis or restore them within an acceptable period of time in order to minimize damage to customers, partners, employees and the company itself.
A BCMS consists not only of recovery plans, but also includes:
- the identification of critical processes and resources (e.g. through business impact analyses),
- defining recovery goals such as RTO (Recovery Time Objective) and RPO (Recovery Point Objective)
- the development of structured response plans and communication channels,
- responsibility regulation, including training and awareness,
- as well as regular testing, maintenance and development of the system (e.g. through emergency exercises).
Ideally, a BCMS is fully integrated into the business model, with interfaces to risk management, information security (ISMS) and operational processes.
With the Aeneis BPM and GRC software, a BCMS is not only documented, but also lived, tested and ready for use at any time — audit-proof, role-based and in accordance with recognized standards such as ISO 22301.
Why every company needs a BCMS
A BCMS not only protects against disasters. It protects against:
- Loss of image among customers & partners
- Penalties for compliance violations
- Production downtime & supply bottlenecks
- Loss of trust among regulatory authorities
- Chaos in case of an emergency
And it secures
- Business continuity
- Digital resilience
- Auditing ability
- Response rate
For whom Aeneis is particularly relevant
Companies that are subject to strict regulatory requirements or are KRITIS relevant — for example in finance, healthcare, the energy sector or mechanical engineering — benefit in particular from a digitally integrated BCMS with Aeneis. Here, auditability, recoverability and resilience are not only useful, but required.
Regulation: What is required — and what is being checked
A robust business continuity management system not only makes sense for many companies, but is also required by law or standards. Regulators, legislators and international standards require structured, verifiable and continuously maintained preparedness in the event of a crisis. The focus is not on pure documentation, but on realistic proof of effectiveness.
The following requirements and standards are particularly relevant for a BCMS:
- ISO 22301: The international standard for business continuity management is the central reference for all companies that want to systematically set up and further develop their BCMS. Among other things, a business impact analysis (BIA), structured recovery plans, regular tests and continuous improvement of the system are required. Aeneis provides support here with methodically managed process documentation, role-based access and documented test planning.
- MaRisk (Minimum risk management requirements): Functioning emergency plans are mandatory for banks and financial service providers. MaRisk requires institution-specific emergency management aimed at continuing essential processes in an emergency — including roles, responsibilities and testing procedures. Here, Aeneis offers an integrated solution that combines regulatory auditable workflows with operational BCM.
- BAIT (Banking supervisory requirements for IT): BAIT supplements MaRisk with specific IT emergency management requirements. Clear structures are required to restore IT services, document dependencies and regular effectiveness tests. With Aeneis, these requirements can not only be met, but also comprehensibly documented and managed centrally.
- DORA (Digital Operational Resilience Act): From 2025, this new EU framework will apply to almost all companies of the financial sector. The focus is on digital resilience and the proof of reliability, particularly in the context of cyberphysical risks. Aeneis helps to systematically model and monitor DORA-compliant processes, risks, recovery strategies, and external dependencies.
- NIS 2 Directive: For companies that fall under the KRITIS regulation, NIS-2 imposes stricter requirements in terms of IT security, incident response and business continuity. Evidence of a current, lived and tested BCMS is becoming mandatory. With Aeneis, these requirements can be monitored in real time and regularly evaluated — at process level, system-related and organization-wide.
- ISO 27001: The standard for information security management also requires measures to restore business activity in the event of IT or security incidents. Here, a BCMS is a fundamental part of the overall security strategy. Aeneis combines ISMS and BCM in one system — with common structures, linked risks and a clear set of responsibilities.
Auditors and supervisory authorities not only expect an emergency file, they expect an integrated, audit-proof and regularly tested system that works in an emergency. With Aeneis, you can implement these requirements in a system-supported, comprehensible and future-proof manner.
BCMS with Aeneis: Rethink resilience digitally
The Aeneis BPM and GRC software is the key to the networked, audit-proof and standard-compliant implementation of a BCMS.
Aeneis combines:
... in a single, powerful system.
Features for your BCM in Aeneis:
- Business continuity plans in the process:
Business continuity plans (BCPs) are stored directly in the processes — clearly structured, testable and ready for use at any time. - Integrated BIA:
Business impact analyses for processes and resources — even without a process model — with a direct link to ISMS categorization. - Critical resources & RPOs:
Documentation of all required resources per process, including recovery point objectives (RPO). - BCMS views & app:
Special views for emergency and process managers; individually configurable BCMS app for easy maintenance. - Automated emergency manual:
Exportable manual including recovery plans & scope, validated for timeliness and completeness. - ISO 22301 standard rules & SoA:
Preconfigured set of rules and SoA template — immediately ready for use, auditable and expandable.
Read more about the BCM in Aeneis here.
Frequently asked questions (FAQ) about BCMS
What is the difference between BCMS and emergency management?
Emergency management describes measures to respond to acute disorders. A BCMS is more comprehensive: It plans strategically, analyses impacts (BIA), defines recovery goals (RTO/RPO), and integrates testing, roles, and documentation.
Does a BCMS also make sense without ISO certification?
Yes, even without formal certification, companies benefit from increased resilience, clear processes and assured ability to act — particularly in the event of internal audits, customer reviews or cyber incidents.
How does Aeneis support the implementation of ISO 22301?
Aeneis provides a complete set of rules, a SoA template, configurable catalogs and much more — ideal for standard-compliant, digital and auditable implementation of ISO 22301.
Can I continue to use existing processes and ISMS structures for BCMS?
Yes, Aeneis enables the direct transfer of ISMS categorizations to BCMS and links them with recovery plans, BIA and responsibilities.
How do I keep the emergency manual in Aeneis up to date?
Using the integrated validator, Aeneis automatically checks whether all BCMS relevant content is available, approved and up-to-date, including roles, documents and validations.
