Business Continuity Management—Identifying Relevant Processes for a Reference Model
Source abstract
Abstract
Currently, a standardized process reference model specifically tailored for the business continuity management system (BCMS) is absent. Moreover, BCMS processes have not been a primary focus of ongoing research endeavors. This paper aims to fill this research gap by presenting findings from a process mapping study concerning BCMS processes within the most prominent and widely acknowledged standards for business continuity management, alongside insights gleaned from expert interviews. The authors propose a collection of BCMS processes that should comprise a BCMS process reference model intended for implementation at a maturity level tailored to individual organizational needs. It aims to strengthen the resilience of organizations to cyber threats and to optimize the processes for effective management within the disaster management cycle. The study identifies and maps the necessary processes required to build a comprehensive BCMS model. These processes include, among others, risk assessment, business impact analysis, the development of BC strategies and solutions, the creation of BC plans and procedures, incident and emergency management, and periodic reviews and exercises. The relevance of these processes was validated through expert interviews, making a clear distinction between core, management, and support processes.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Supply Chain Resilience and Risk Management · Infrastructure Resilience and Vulnerability Analysis · Disaster Management and Resilience
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Departamento de Organización de Empresas I, Universidad de Granada, 18012 Granada, Spain
EY Consulting GmbH, 10117 Berlin, Germany
Information Systems Institute, SRH Heidelberg University, 69123 Heidelberg, Germany
References (37)
Show source-provided references
1. Al Ali, J., Nasir, Q., and Dweiri, F.T. (April, January 26). Business continuity management framework of Internet of Things (IoT). Proceedings of the 2019 Advances in Science and Engineering Technology International Conferences (ASET), Dubai, United Arab Emirates.10.1109/ICASET.2019.8714483 ↗
2. (2019). Security and Resilience—Business Continuity Management Systems—Requirements (Standard No. ISO 22301:2019).
3. (2020). Security and Resilience—Business Continuity Management Systems—Guidance on the use of ISO 22301 (Standard No. ISO 22313:2020).
4. A framework for business continuity management
5. Organizational dashboards: Steering an organization towards its mission10.1081/QEN-200059847 ↗
6. Dey, M. (2011). Business Continuity Planning (BCP) methodology—Essential for every business. Proceedings of the 2011 IEEE GCC Conference and Exhibition (GCC), Dubai, United Arab Emirates, 19–22 February 2011, IEEE.10.1109/IEEEGCC.2011.5752503 ↗
7. (2022). Information security, Cybersecurity and Privacy Protection—Information Security Management Systems—Requirements (Standard No. ISO/IEC 27001:2022).
8. (2022). ISO/IEC Directives, Part 1: Consolidated ISO Supplement—Procedure for the Technical Work—Procedures Specific to ISO—Annex SL Harmonized Approach for Management System Standards, International Electrotechnical Commission.
9. (2021). Security and resilience—Business Continuity Management Systems—Guidelines for Developing Business Continuity Plans and Procedures (Standard No. ISO/TS 22332:2021).
10. (2021). Security and Resilience—Business Continuity Management Systems—Guidelines for Business Impact Analysis (BIA) (Standard No. ISO/TS 22317:2021).
11. Miller, H.E., and Engemann, K.J. (2022). Business continuity management in data center environments. Research Anthology on Business Continuity and Navigating Times of Crisis, IGI Global.10.4018/978-1-6684-4503-7.ch081 ↗
12. Maturity Models for Business Continuity—A Systematic Literature Review
13. (2021). Information Technology—Guidance on Information Security Management System Processes (Standard No. ISO/IEC TS 27022:2021).
14. Stevenson, W.J., and Sum, C.C. (2014). Operations Management, McGraw-Hill/Irwin.
15. International Organization for Standardization, and International Electrotechnical Commission (2018). ISO Handbook—The Integrated Use of Management System Standards (IUMSS), ISO.
16. (2018). Information Technology—Security Techniques—Information Security Management Systems—Overview and Vocabulary (Standard No. ISO/IEC 27000:2018).
17. (2015). Quality Management Systems—Fundamentals and Vocabulary (Standard No. ISO 9000:2015).
18. Scheer, A.-W., and Nüttgens, M. (2002). ARIS architecture and reference models for business process management. Business Process Management: Models, Techniques, and Empirical Studies, Springer.
19. (2015). Information Technology—Process Assessment—Requirements for Process Reference, Process Assessment and Maturity Models (Standard No. ISO/IEC 33004:2015).
20. (2015). Information Technology—Process Assessment—Requirements for Process Measurement Frameworks (Standard No. ISO/IEC 33003:2015).
21. (2025). Security and Resilience–Vocabulary (Standard No. ISO 22300:2025).
22. Lehto, M. (2022). Cyber-attacks against critical infrastructure. Cyber Security: Critical Infrastructure Protection, Springer.10.1007/978-3-030-91293-2 ↗
23. A general supply chain continuity management framework10.1016/j.procs.2015.07.087 ↗
24. Contemporary Threats to the Continuity of Transport Systems
25. Pardo, C., Pino, F.J., García, F., Piattini, M., and Baldassarre, M.T. (2010). A process for driving the harmonization of models. Proceedings of the 11th International Conference on Product Focused Software, Limerick, Ireland, 21–23 June 2010, Association for Computing Machinery.10.1145/1961258.1961271 ↗
26. Structure-mapping: A theoretical framework for analogy
27. Explicit scientific knowledge comparison based on semantic description matching10.1002/meet.2008.1450450210 ↗
28. Predoiu, L., Feier, C., Scharffe, F., de Bruijn, J., Martin-Recuerda, F., Manov, D., and Ehrig, M. (2005). D4.2.2 State-of-the-Art Survey on Ontology Merging and Aligning V2; EU-IST Integrated Project IST-2003-506826 SEKT, Digital Enterprise Research Institute, University of Innsbruck.
29. ISMS core processes: A study10.1016/j.procs.2016.09.167 ↗
30. Slack, N., Chambers, S., and Johnston, R. (2010). Operations Management, Pearson Education.
31. Information Systems Audit and Control Association (2013). COBIT 5 Process Assessment Model (PAM): Using COBIT 5, Information Systems Audit and Control Association.
32. Best practices for survey research reports: A synopsis for authors and reviewers10.5688/aj720111 ↗
33. Consensus statements on the assessment of older drivers10.5770/cgj.17.111 ↗
34. Blackley, J.A., Peltier, T.R., and Peltier, J. (2004). Information Security Fundamentals, Auerbach Publications.10.1201/9780203488652 ↗
35. Developing and enforcing internal information systems standards: InduMaker’s Standards Management Process
36. Toward an integration of organization research and practice: A contingency study of bureaucratic control and performance in scientific settings10.2307/2392388 ↗
37. Introducing a novel multi-objective optimization model for volunteer assignment in the post-disaster phase: Combining fuzzy inference systems with NSGA-II and NRGA10.1016/j.eswa.2023.120142 ↗