BCM software for ISO 22301 and NIS-2, built for the European mid-market
Business continuity operations with business impact analysis, continuity plans, RTO validation against real BIA data, threat scenarios, gap analysis and BCM tests. All in one platform that shares its data layer with ISMS, TPRM and Assessment. Hosted in Germany.
Request a BCM module demo
What the BCM module covers
The BCM module implements ISO 22301 as live operations, not as a Word emergency manual that gathers dust after the audit. The evidence emerges from the real process and asset data that the ISMS and TPRM modules already maintain.
Business impact analysis with real dependencies
Business processes, maximum tolerable period of disruption (MTPD), resource requirements and dependencies on applications, sites and suppliers. The BIA pulls the asset inventory from the ISMS module and supplier criticality from the TPRM module, instead of capturing them a second time by hand.
Continuity plans with automatic RTO validation
Recovery plans per critical process with defined RTO and RPO targets. The platform checks every Recovery Time Objective against the target set for the process in the BIA and reports an error as soon as the plan exceeds that target. Static plans become a verifiable target-versus-actual comparison.
Threat scenarios and gap analysis
Scenario catalogue from power outage through ransomware and supplier failure to staff and building loss, with gap analysis against existing plans. Critical suppliers from the TPRM module automatically generate matching disruption scenarios.
BCM tests from tabletop to full test
Planning, execution and documentation of exercises, from tabletop walkthrough to full test, including lessons learned and measure feedback. A coherent test history as evidence for auditors and insurers.
Crisis and emergency management
Alerting chains, crisis team roles, escalation levels and communication templates, interlocked with the ISMS module's incident management. An incident escalates to a crisis without rebuilding the context.
Compliance score and management review
Auto-populated KPIs from live BCM operations, maturity score and review templates for board, supervisory board, auditors and insurers. Revision-safe snapshots document the status at any reporting date.
What the gap analysis looks like
Per process: severity, impact, whether plan, strategy and test exist, and the gap to the recovery objective. Above it the trend across six months. From the software, not a mock-up.
No CISO of your own?
In a vCISO mandate, your vCISO works with OdySecure and the platform is included. From €3,600/month.
Standards and frameworks covered by the BCM module
The BCM module covers the ISO 22301 family and integrates the complementary standards relevant for DACH. No fragmented multi-tool architecture, but one data layer for ISMS, BCM and TPRM.
- ISO 22301:2019 as the main standard for business continuity management systems (BCMS)
- ISO 22313 as implementation guidance for ISO 22301
- ISO/IEC 27031 for ICT readiness for business continuity
- BSI Standard 200-4 (Business Continuity Management) with its staged model reactive, build-up, standard
- NIS-2 requirements for business continuity and crisis management per German BSIG § 30
- DORA requirements for ICT business continuity and recovery for financial service providers
- Mapping to ISO 27001:2022 Annex A (A.5.29 information security during disruption, A.5.30 ICT readiness)
Who the BCM module is built for
Three constellations in which the BCM module replaces the Word-Visio emergency manual economically and keeps the plans permanently current.
Mid-market companies with NIS-2 BCM obligations
NIS-2 requires business continuity and crisis management. A Word emergency manual does not pass the audit if the plans were never tested and never validated against real data. Without in-house BCM practice: under a vCISO mandate, a senior CISO leads the rollout of the NIS-2 BCM requirements and works with this module; the platform is included in the mandate. BIA and plans come from real process data, audit-ready rather than theoretical.
About the vCISO mandateEnterprises with BCM but no data linkage
Existing BCM in Word and Visio, BIA data outdated, RTOs never checked against actual recovery times. The platform links the BIA to the asset inventory from the ISMS and supplier criticality from the TPRM, so the plans stay current without anyone manually refreshing them once a year.
Financial service providers under DORA
DORA requires tested ICT business continuity and recovery. The BCM module delivers scenarios, tests and revision-safe evidence, aligned with the TPRM module for critical ICT third parties and the ISMS module for the underlying controls.
FAQ about the BCM module
What is the difference between a BCM tool and a BCM platform?▼
Which standard does the BCM module implement?▼
How does the BCM module validate RTOs?▼
Does the BCM module support DORA and NIS-2 concretely?▼
How are BCM tests documented?▼
Where is the BCM hosted?▼
BCM is one module of OdySecure
The BCM module shares the data layer, permission model and audit trail with the ISMS module (information security per ISO 27001), TPRM (third-party risk management) and Assessment (OSCAL import and custom catalogues). The BIA pulls assets from the ISMS, critical suppliers from the TPRM generate threat scenarios in the BCM. There are no mandatory modules: licensing is modular, modules build on each other without forcing each other.
See the full platformMemberships, programmes and partnerships
