Gartner on Business Continuity Management


Business continuity management is crucial to ensuring the enterprise’s resilience and viability following disruptive events. Business operations leaders, CIOs, IT leaders and technical professionals can use this overview for guidance in developing, implementing and managing critical BCM initiatives.


Business continuity management (BCM) ensures business resilience before, during and after a disruption. This has become a crucial initiative in an increasingly complex, interconnected global economy.

As Figure 1 shows, BCM is composed of seven key disciplines essential for implementing a complete BCM program. In this research, all seven disciplines are included in the discussion when we refer to a BCM program. BCM has moved beyond its traditional focus on recovering IT systems following a disaster to a broader concern with ensuring the ongoing resilience of critical business processes. Enterprises that fail to practice effective BCM planning could risk catastrophic business failures caused by events, such as natural disasters, disease outbreaks, supply chain failures and man-made events.

BCM now requires not only technical expertise, but also a detailed understanding of business requirements; legal and regulatory requirements; effective collaboration with emergency management authorities; the demands of the enterprise’s industry vertical and key business partners; and worldwide political, cultural and environmental issues.

What Business Continuity Management Means to CIOs

When developing and maturing a BCM program, CIOs working with COOs, chief risk officers (CROs) and BCM professionals should:

  • Understand the regulatory, political, cultural, environmental and contractual demands facing the enterprise.
  • Document the alignment of BCM to strategic business objectives, key performance indicators, key availability risk indicators and the enterprise risk management program.
  • Assess the maturity of the enterprise’s BCM program by benchmarking against an existing BCM standard or framework.
  • Assess the maturity of the enterprise’s BCM program by benchmarking against an existing BCM standard or framework.
  • Manage the closure of gaps in BCM program capabilities as measured by the differences between recovery expectations and what the business and IT can actually provide.

What Business Continuity Management Means to IT Leaders

When developing and maturing a BCM program, IT leaders working with BCM and IT disaster recovery management (IT DRM) professionals should:

  • Identify the recovery requirements from availability risk assessments and business impact analyses of mission-critical processes, IT services and suppliers.
  • Utilize program management automation to improve the maturity and efficiency of the BCM program.
  • Monitor the impact of changes to business process and IT service delivery on the BCM program, including new products/services, personnel skill sets, workforce size, demographics, suppliers, regulations, contracts, cloud and virtualization adoption, data center consolidation, and other initiatives.
  • Develop processes and procedures to implement the BCM program. Close gaps as measured by expectations of recovery versus actual recovery capabilities.
  • Ensure the BCM budget aligns to business and IT recovery requirements.

What Business Continuity Management Means to Technical Professionals

When developing and maturing a BCM program, technical professionals should:

  • Implement technologies such as virtualization, cloud computing, active/active applications and data centers to enable improvements.
  • Apply other technologies and services to better support recovery time objectives (RTOs) and recovery point objectives (RPOs) or lower recovery costs, including backup, data replication, recovery-as-a-service, virtual machine recovery, recovery assurance, IT service dependency mapping and IT service failover automation tools.
  • Use automated solutions for BCM planning, emergency/mass notification and crisis/incident management to improve the BCM program.
  • Develop processes and procedures to facilitate the implementation of the IT DRM program.
  • Close gaps in the IT DRM program as measured by expectations of recovery versus actual recovery capabilities.

Conduct Your Business Continuity Management Initiative Using This Structured Approach

Effective BCM programs require “before and after” comparisons at each phase. Keep a business focus, and implement these steps:

  • Strategize and Plan: Draft a charter to gain agreement on the vision for the initiative, in alignment with business goals. Scope the initiative, and establish resources and budget. Integrate with strategic IT and business plans.
  • Drive Change Management: Set up a system to communicate and socialize ideas via multiple channels. Get buy-in from stakeholders at all levels. Assess progress, and drive stakeholder commitment to the change.
  • Execute: Optimally operate the initiative in accordance with business goals. Update and drive new elements of the initiative in response to changing business requirements.
  • Measure and Improve: Measure how the initiative has affected business outcomes. Seek feedback from stakeholders. Drive improvements through process changes and upgrades.