Features included from Business: Business continuity (BCM), compare packages
Business continuity (BCM)
Know which process has to run again first: business impact analysis, plans, crisis team and exercises in one module.
When a central system fails, it has to be clear which process must run again first, how long an outage can be tolerated and who decides.
How Complass helps
Business impact analysis
Rate the damage per category over time in a matrix. Complass suggests the maximum tolerable period of disruption (MTPD) and the criticality from it. Plus dependencies, resources, approval, review cycle and the BIA report as PDF or Excel.
Recovery objectives per process
Recovery time objective (RTO) and recovery point objective (RPO) per process. The RTO must be shorter than the MTPD, as provided for in BSI-Standard 200-4.
Business continuity plans with approval
Recovery, emergency operation and alerting plans, prefilled from the BIA. Every release is stored as an unchangeable version, optionally with the four-eyes principle.
Crisis team and emergency manual
Crisis team, emergency teams and external contacts with deputies and availability. The emergency manual brings everything together, as PDF or Word file; Complass shows who has downloaded an outdated copy.
Exercises per BSI-Standard 200-4
From the plan review to the emergency exercise: measured recovery times per process compared with the objectives, findings as tasks and the exercise report as PDF.
Evidence for your frameworks
You file the emergency manual and the exercise report as evidence in your projects with one click, for example for NIS2 and ISO 27001.
When it happens
Declare an emergency
You declare the emergency with a renewed confirmation, Complass alerts the crisis team and tracks who has confirmed. Afterwards the post-incident report is created.
Backups and restore
Per system you see whether the backup matches the tolerable data loss, whether a copy is offline or immutable and when a restore last succeeded.
Additional alerting by SMS and voice call: add-on.
Legal and normative basis
- § 30 Abs. 2 Nr. 3 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …Open original (gesetze-im-internet.de) ↗
- Art. 21 Abs. 2 lit. c NIS2-RichtlinieArticle 21 NIS 2 Directive Cybersecurity risk-management measures1. Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other …Open original (EUR-Lex) ↗
- BSI-Standard 200-4
- ISO 22301:2019
- ISO/IEC 27001:2022, A.5.29 und A.5.30
Read the business continuity (BCM) whitepaper
This page describes Complass features and is not legal advice.
Frequently asked questions
Is business continuity included in the package?
Business continuity is a bookable add-on. It is included in the Business, Professional and Premium packages.
Where do we start?
With your most important processes and their business impact analysis. The quick start, based on the reactive BCMS of BSI-Standard 200-4, takes you on via the first plan and the crisis team to the first exercise; the plans are prefilled from the results of the BIA.
Does the module support ISO 22301?
Yes. With business continuity you get ISO 22301 as a framework with its requirement catalogue; BIA, plans and exercises count as evidence there.
Does Complass replace the decisions in business continuity management?
No. Complass makes suggestions, checks entries and documents. You set the objectives, plans and approvals; responsibility remains with you.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.