Translated from the German original. Read the original in German.
Three intensive days of training to become a Business Continuity Manager (DGI Deutsche Gesellschaft für Informationssicherheit AG) are behind me – and it was well worth it.
The course run by Sollence was not only a deep dive into ISO 22301, ISO 27031 and the German BSI Standard 200-4, but above all a look at practice: how do I build an effective, resilient BCMS that is ready for certification?
Here are my key takeaways:
🔹 1. Business continuity is a matter for top management – and for the organisation
A BCMS only works if top management takes responsibility, establishes governance and provides resources. The Business Continuity Manager role is clearly conceived as a staff function – with a mandate, accountability and direct access to senior leadership.
🔹 2. No BCMS without an understanding of the business processes
A major focus was the structured mapping of business processes:
• core processes
• sub-processes
• upstream and downstream process steps
• dependencies on applications, data, premises, infrastructure, etc.
Only if you know your information domain can you really practise BCM. (See, for example, the mapping tables and CMDB examples in the presentation.)
🔹 3. BCM is not part of the ISMS – it is a management system in its own right
The training made it clear: BCM ≠ ISMS.
But the synergies are considerable – from PDCA and document control to joint risk analysis.
Particularly interesting was the comparison of escalation levels (disruption → emergency → crisis → disaster) across BCMS, ISMS and ITIL.
🔹 4. Legal requirements are a massive driver of BCM
NIS2, the German KRITIS-DachG, DORA, CRA, AI Act – the EU is significantly tightening its requirements for operational resilience. BCM is therefore no longer a “nice to have” but a compliance obligation.
The training makes it very clear: without a structured BCMS, it will not be possible to meet future requirements or to restart business processes.
🔹 5. Building a BCMS is a multi-stage project
The course covered the complete lifecycle, from strategy and organisation through to the exercise programme:
• developing the BC strategy
• defining scope & context
• BIA & risk analysis
• BCM measures & contingency plans
• exercises, tests, reviews
• continuous improvement
The BC manager thus becomes the navigator through crises and uncertainty – and ensures that critical business activities can be restored.
🔹 My personal conclusion
The training offers real depth of content and shows that business continuity is far more than an “emergency binder & IT recovery”.
It is a strategic leadership tool for making organisations resilient, managing risks transparently and remaining able to act when it matters.
I can therefore wholeheartedly recommend the training to anyone.
Thanks to Andreas Altena, Angelika Müller and Ronny Neid.
