Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
A curated set of business continuity and disaster recovery resources — the standards, templates, certifications and platforms that a BCM programme actually draws on. Every entry has a note on what it is for, because a link list without judgement just moves the research problem somewhere else.
Standards and frameworks
- ISO 22301 — the certifiable business continuity management system standard. Start with clause 8: 8.2 (business impact analysis and risk assessment), 8.3 (strategies), 8.4.4 (what a continuity plan must actually contain) and 8.5 (exercise and test). Most programme gaps trace back to 8.4.4 and 8.5.
- ISO 22398 — guidelines for exercise programmes. The companion nobody reads. If your exercises lack defined objectives and evaluation criteria, this is the fix.
- NIST SP 800-34 Rev. 1 — contingency planning for information systems. Stronger than ISO 22301 on the IT recovery specifics: system categorisation, recovery strategies, testing types.
- BCI Good Practice Guidelines — the practitioner’s methodology, organised around the BCM lifecycle. The most practical of the four if you are building a programme from scratch.
Regulatory expectations in the GCC
If you operate in Saudi Arabia, the international standards are the floor, not the requirement. SAMA expects regulated financial institutions to maintain a documented BCM programme with tested recovery capability, defined recovery time objectives for critical services, and evidence that exercises produce corrective action. NCA frameworks add cybersecurity resilience requirements that overlap with, but do not replace, BCM obligations.
Related reading: SAMA IT Governance Framework compliance, NCA critical system compliance, and cyber resilience and business continuity management.
Free templates and planning tools
- FEMA Continuity Toolkit — continuity plan templates and guidance. Public-sector framing, but the plan structure transfers.
- Ready.gov Business Continuity Planning Suite — a free guided tool. Best fit for smaller organisations with no existing programme.
- DRI International resources — professional practice templates aligned to the DRI methodology.
A caution on templates: they are useful for structure and dangerous for content. A filled-in FEMA template describing a US federal agency’s recovery posture is not your plan. Use them for the skeleton, then write the steps your recovery team will actually follow.
Exercising and testing
- FEMA exercise programme (HSEEP) — exercise design, conduct and evaluation methodology.
- Ready.gov plan testing guidance — a straightforward introduction to testing types.
Our own material on running these: tabletop exercises for incident response and disaster recovery scenario development.
Professional bodies and certification
- Business Continuity Institute (BCI) — membership grades from AMBCI to FBCI, built on the Good Practice Guidelines.
- DRI International — the other major body. CBCP is the common practitioner credential; MBCP is the senior one.
- PECB ISO 22301 — lead implementer and lead auditor certification. The route to take if your goal is certifying the management system.
- ISACA business continuity resources — the audit and assurance perspective on BCM.
BCM software platforms
Disclosure: BCMStack, listed below, is our own product. The rest are independent vendors listed on merit.
- Fusion Risk Management — established enterprise platform, strong on dependency mapping.
- ServiceNow BCM — the natural choice if you already run ServiceNow, since it inherits the CMDB.
- Archer — broad integrated risk management suite with a BCM module.
- BCMStack — operational resilience and BCM built for SAMA-regulated banks, insurers and fintechs in Saudi Arabia. Native ISO 22301 §8.4.4 plan structure, phased recovery, and a §8.5 activation log capturing every invocation.
When comparing platforms, the question that separates them is whether the plan is built to be authored or to be invoked. Our BCM software buyer’s guide sets out the full evaluation criteria.
