Business Continuity Management · Glossary

Business Continuity Management, BCM for short, refers to an organisation's structured ability to continue critical processes during disruptions, maintain them at a reduced level, or restore them within defined times. It does not mean a single emergency measure but a management system. It defines which functions must be protected as a priority, which resources are needed for this, who decides when an incident occurs, and how exercises are carried out so that plans actually work in operation. In German-speaking countries, BSI Standard 200-4 provides practical guidance for establishing such a business continuity management system (BCMS). Internationally, the standard ISO 22301:2019 is authoritative.

BCM in the power system

In the power system, BCM does not concern only office processes or general corporate organisation. It affects control centres, grid operation, power plant operation, metering point operation, market communication, IT systems, telecommunications, customer service, billing, supplier relationships, spare-parts logistics, access control, shift planning and crisis communication. A transmission system operator, a distribution system operator, an energy supplier or the operator of a larger generation plant must know which activities have to continue when personnel, buildings, data connections, software, service providers or physical assets fail. BCM translates this question into priorities, recovery times and prepared courses of action.

Time as the central variable

The central variable in BCM is not kilowatts, kilowatt-hours or grid frequency, but time. The starting point is usually a business impact analysis (BIA). It determines how the failure of a process develops over time and from when onwards unacceptable damage occurs. Three key parameters are typically derived from it:

Maximum tolerable period of disruption: This is the period after which a failure would have unacceptable consequences. In German it is called maximal tolerierbare Ausfallzeit.
Recovery time objective: This is the planned time until a process is available again at least at an emergency operating level. It must be shorter than the maximum tolerable period of disruption.
Recovery point objective: It specifies the maximum acceptable data loss, for example up to which point in time before the failure metering, schedule or billing data must be restored.

To illustrate: a control centre function tolerates only very short interruptions, whereas some administrative processes can wait several days. This gradation prevents all processes from being treated as critical across the board. At the same time, it makes visible dependencies that are easily overlooked in normal operation: the power supply of the company's own sites, telecommunications, data access, building access, qualified personnel, external service providers and available spare parts. BSI Standard 200-4 also distinguishes the escalation levels disruption, emergency and crisis. This makes clear from when normal operation is left and which structures then take effect.

Distinction from related concepts

BCM is closely linked to resilience, but they are not the same. Resilience describes the ability of a system to absorb disruptions, adapt and preserve core functions. BCM is an organisational instrument with which a company prepares this ability for its own processes. Risk management assesses probabilities of occurrence and damage magnitudes and decides on risk-reduction measures. BCM, by contrast, assumes more strongly that disruptions occur despite prevention. It then asks which function must be stabilised or restored in which order.

IT contingency planning and BCM are often equated. This equation narrows the concept. IT recovery, data backup, backup data centres and protection against cyberattacks are indispensable for many energy companies. They are often organised as IT service continuity management (IT-SCM) but answer only part of the continuity question. A functioning data centre alone does not keep a grid operator able to act if the control room is unusable, communication channels to field crews fail, shift staff cannot travel to work or a service provider cannot deliver replacement components. BCM therefore starts with the process and derives technical, personnel and contractual requirements from it. BSI Standard 200-4 explicitly points to synergies with IT-SCM and information security management (ISMS).

Crisis management organises decisions under exceptional pressure, for example through crisis teams, situation pictures, escalation paths and communication with authorities. BCM provides prepared foundations for this: prioritised processes, emergency manuals, alternative sites, contact chains, minimum staffing levels and recovery plans. When an incident occurs, both areas work together. Without BCM, a crisis team has to clarify many questions only when time is already being lost. Without crisis management, BCM plans easily remain documents that are not translated into decisions.

Dependencies in the energy sector

BCM is particularly important for the power system because many other sectors depend on electricity, while the power supply itself relies on other infrastructures. Grid operation requires telecommunications, control technology, weather data, market information, vehicles, spare parts and personnel. Power plants and storage facilities require fuel logistics, control systems, cooling, access security and often external maintenance. Metering, balancing and supplier switching depend on standardised data processes. A failure in one of these areas cannot be bridged by improvisation for an unlimited time. BCM determines where manual procedures are possible, where technical redundancy is required and where a function is deliberately reduced if a system fails.

Legal framework in Germany (as of November 2026)

In the regulated energy sector, BCM is not only good practice but is in part required by law. Which obligations apply depends on role, size and type of facility. Three regulatory strands are currently particularly relevant:

BSI Act: Since the implementation of the NIS 2 Directive at the end of 2025, § 30 BSIG obliges particularly important and important entities to take risk management measures. The minimum content expressly includes maintaining operations, for example backup management and recovery after an emergency, as well as crisis management. Compliance must be documented.
Energy Industry Act: Under § 5c EnWG, operators of energy supply networks as well as certain operators of energy installations and digital energy services must adequately protect the telecommunications and data processing systems that are necessary for safe operation. The specific requirements are set by the Federal Network Agency (Bundesnetzagentur) in agreement with the BSI in an IT security catalogue. Among other things, this must contain requirements on maintaining operations, crisis management, supply chain security and, where applicable, secured emergency communication systems.
KRITIS Umbrella Act (KRITIS-Dachgesetz): This act on the physical resilience of critical facilities has applied since 17 March 2026. Operators of critical infrastructure must accordingly register, carry out risk analyses based on an all-hazards approach and implement resilience measures on the basis of a resilience plan. Which facilities are specifically covered depends on a statutory ordinance with threshold values.

These requirements do not replace operationally oriented BCM. They set a framework within which companies must analyse their specific processes. A formally existing plan says little about whether alternative workplaces are reachable, whether on-call duty is organised robustly or whether employees can apply the intended procedures under realistic conditions. Standards such as ISO 22301 and BSI Standard 200-4 offer methodological guidance for this. The BSI Standard provides a stage model, from the reactive BCMS through the build-up BCMS to the ISO-compatible standard BCMS.

Typical misinterpretations

Misinterpretations often arise when BCM is understood as a pure documentation obligation. An emergency manual serves its purpose only if telephone numbers are correct, decision-making authority is clarified, backup systems are tested regularly and exercises show where processes break down. Many weaknesses lie not in missing technology but in unclarified interfaces. Who passes a situation report on to whom? Who may start a fallback process? Which data may be used manually when IT is disrupted? Which contracts secure the availability of service providers even when several companies are affected at the same time? Such questions seem administrative but determine actual operational capability.

Another misconception is to think of availability solely in terms of redundancy. Duplicate servers, backup lines or additional sites increase robustness if they are designed and maintained with sufficient independence. However, they create new requirements for operation, maintenance, synchronisation and personnel. Redundancy that is not tested in everyday operation can itself become a source of uncertainty in the event of a failure. BCM therefore combines technical measures with organisational routines: exercises, deputising arrangements, clear trigger criteria and the deliberate decision on which services may initially be dropped when resources are limited.

Digitalisation and electrification

With increasing digitalisation and electrification, the importance of BCM grows. Heat pumps, electromobility, flexible loads, decentralised generation and smart metering systems not only increase electricity demand. They also change the requirements for control, data processing and communication. At the same time, market and grid processes become more time-dependent: schedules, balancing groups, redispatch, forecasts and switching operations must function within defined deadlines. Failures in data chains can therefore have operational and economic consequences even if electricity is still physically flowing. BCM makes this dependency between digital process and technical supply visible.

Relation to security of supply

For assessing security of supply, BCM is a complementary concept. Security of supply is often discussed in terms of generation capacity, grid expansion, reserve capacity or frequency maintenance. These variables remain central but do not capture all prerequisites of operation. A power system also needs organisations that remain able to act during disruptions. This includes well-rehearsed situation assessment, robust communication, available skilled staff and reliable interfaces between companies, authorities and service providers. BCM describes this operational level of continuity.

Economic trade-off

Economically, it is a matter of weighing precautionary costs against damage limitation. Fully securing every process would be expensive and often technically pointless. Too little precaution shifts the costs to the incident: downtime, breaches of contract, regulatory consequences, safety risks and loss of trust then threaten. BCM makes this trade-off explicit. It does not require maximum protection of all activities but a reasoned prioritisation according to process criticality, recoverability and dependencies. The law also follows this idea of proportionality: § 30 BSIG requires, among other things, that risk exposure, the size of the entity and implementation costs be taken into account. § 5c EnWG names similar factors for the IT security catalogue.

Conclusion

Business Continuity Management translates vulnerability into prepared operational capability. In the power system, it does not protect a company in the abstract but the functions needed for grid operation, market processes, plant control and communication. The term is used precisely when it describes the connection between critical process, permissible downtime, required resource and rehearsed responsibility.

Sources

Energiewirtschaftsgesetz (EnWG) § 5c IT-Sicherheit im Anlagen- und im Netzbetrieb, Festlegungskompetenz — Bundesministerium der Justiz / Bundesamt für Justiz (gesetze-im-internet.de); unbekannt (Fassung seit 6. Dezember 2025). § 5c Abs. 1, 2, 3 und 4 Nr. 3, 4 und 10 EnWG
BSI-Gesetz (BSIG) § 30 Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen — Bundesministerium der Justiz / Bundesamt für Justiz (gesetze-im-internet.de); unbekannt. § 30 Abs. 1 und Abs. 2 Nr. 3 BSIG
BSI-Standard 200-4 verhilft mit Business Continuity Management zu ganzheitlicher Resilienz — Bundesamt für Sicherheit in der Informationstechnik (BSI); 2023-06-14. Pressemitteilung
BSI-Standard 200-4 Business Continuity Management — Bundesamt für Sicherheit in der Informationstechnik (BSI); unbekannt (Standard veröffentlicht Juni 2023). Downloadseite des Standards
KRITIS-DachG ist in Kraft getreten — dsn group (Sekundärquelle); 2026-03-17. Abschnitte zum Inkrafttreten und zu den Betreiberpflichten

Related glossary entries

Edited by eCMS on 11.11.2026 16:34