C5 domain BCM: planning, testing and evidencing continuity

This page covers the BCM domain (Business Continuity Management) of C5:2026, section 5.14 of the catalogue. How criteria and subcriteria are structured in general is explained on the page C5 criteria catalogue.

What is the BCM domain about?

BCM requires the provider to analyse outages of its service in advance, to have plans for them and to test these plans regularly. With four criteria, BCM-01 to BCM-04, it is one of the smallest domains in C5:2026: ten basic subcriteria and four complementing additional subcriteria; there are no sharpening ones. According to the BSI change history, no BCM criterion is without a predecessor in C5:2020. The restore tests of the data backup are in the OPS domain (OPS-08), but belong here in substance, because they show whether your recovery objectives can be achieved.

Starting point: a SaaS provider whose outage is noticed immediately

Fictitious example, not a client. A provider runs inventory management with point-of-sale integration for pharmacies as SaaS. Through it, the pharmacies order from wholesalers, book incoming goods and sell at the till; pharmacies on emergency duty also work at night. The service runs on a cloud platform in one region with several availability zones, and the data backup goes daily to a second region. There is an emergency manual, but the team has never rehearsed a complete recovery in the second region. In tenders, customers ask for the C5 attestation and for the recovery times.

Who is responsible for what: provider, platform, customer?

The provider is responsible for the continuity of its service, even if the platform supplies part of the resilience. Customers, for their part, have to plan for an outage of the service; for this the catalogue lists complementary customer criteria for BCM-02, BCM-03 and BCM-04.

If your service relies on such precautions at the customer, describe them as complementary customer controls (also called complementary user entity controls, CUEC) in the system description; the complementary customer criteria in the catalogue are general notes. More on this on the page Complementary customer criteria.

How do the four BCM criteria fit together?

As a chain from analysis to test that is run through at least annually. The list is our summary; the wording of the criteria in the catalogue is binding.

• BCM-01, the system: A business continuity and emergency management system in accordance with ISO 22301 and/or BSI Standard 200-4, with documented policies. A certificate under ISO 22301 can fulfil the basic criterion, but is not required. Top management or one of its members is named as the process owner; the responsibility may be delegated to a person who can steer the business continuity strategy for the whole service just as well.
• BCM-02, the analysis: The business impact analysis determines, among other things, critical products, dependencies including service organisations, the maximum tolerable period of downtime, the recovery time objective (RTO) and the maximum permissible data loss (RPO). Review at least annually or after significant changes.
• BCM-03, the plans: The analysis results in plans with designated owners, communication channels including notification of the customers, recovery procedures and interim solutions. The plans must be accessible to the people who are to carry them out.
• BCM-04, the tests: The plans are tested, documented and evaluated at least annually or after significant changes. Affected customers and relevant third parties, for example service organisations, are involved.

According to the supplementary information on BCM-04, a customer is “affected” if the test pushes the service below the level agreed in the SLA or if the plans can only be tested by the customer taking action. In our understanding, a test in a separate environment that neither restricts the customers nor requires them to act therefore does not need customer involvement. BCM is also linked with service organisations through SSO-06: exit strategies for service organisations with a very high dependency have to be aligned with the business continuity plans.

Recovery and restore evidence: BCM-04 and OPS-08 together

Proof, with measured values, that the objectives from the business impact analysis were achieved in the test. Two types of test complement each other:

The complementing subcriterion OPS-08.02AC requires restore tests to be part of business continuity management; even without this additional criterion we recommend keeping both tests in one test plan. If the data backup is not contractually agreed with the customers, OPS-08 is not applicable; you present this in the system description. Policy and monitoring of the data backup (OPS-06, OPS-07) are covered on the page OPS.

In an initial engagement, a disaster recovery test that has not yet been carried out can also be evidenced through records of the planning or templates for the documentation (section 3.4.11); see Type 1 or type 2. You also provide your recovery parameters such as RTO, RPO and minimum business continuity objective to the customers’ subject matter experts on request, and the system description states where this information can be found (general condition GC-03). If contractual availability commitments were missed in the type 2 period or the data backup failed, this belongs in the system description as a significant event, see Significant changes and events.

Example control description for BCM-04

This is how the annual recovery test in the example could be described; the template is our own wording, not catalogue text. The values for RTO and RPO are invented.

What evidence the auditor wants to see

Documents that refer to each other, and test records with measured values. Our overview for the example:

How to keep this evidence in a register is shown on the page Evidence and documentation.

Possible gaps: cause, effect, remedy

We derive the gaps from the requirements of the catalogue; they are not auditor findings.

All criteria of the BCM domain

Titles as in the English version 1.0.1, number of subcriteria counted per section 5 (B = basic, AS = sharpening, AC = complementing). The column “What it covers” is our own short description, not catalogue text; the wording of the criteria in the catalogue is binding.

Closely related, but in other domains: data backup and recovery OPS-06 to OPS-09 (OPS), exit strategies SSO-06 (SSO) and the information on recovery parameters in general condition GC-03. Security incident management is covered by the SIM domain.

Relationship to ISO/IEC 27001:2022 Annex A

The following mapping is our own, unofficial classification by topic. The BSI has not yet published a cross-reference for C5:2026. The catalogue refers to the BSI website for it (section 3.3). So far the table there covers C5:2020 only, and the BSI says the table for C5:2026 is “scheduled for publication in the near future” (as of 6 November 2026). According to the catalogue, even an official table only shows thematic proximity, not fulfilment of the criteria (section 3.3). The short labels are ours, not titles from the standard. BCM-01 itself refers to ISO 22301 and BSI Standard 200-4; ISO/IEC 27001 covers continuity only from the perspective of information security.