Core, management and support processes
Sort the BCMS processes into core, management and support, so the map shows what delivers continuity, what directs the system and what keeps it running.
Basis: Our reading. The public record does not name a classification. The draft text is not public. This page reads the public scope and the held ISO 22301:2019 clause set, and does not quote either as draft text.
01What applies
A useful process map separates three kinds of process. Core processes deliver continuity directly: impact analysis, risk assessment, strategy and solutions, plans, exercises and evaluation. Management processes direct the system: context and scope, leadership and policy, planning and change, performance evaluation and improvement. Support processes keep it running: resources, competence, awareness, communication and documented information. The public record does not use this classification, and this site does not claim that it does. The classification is a practical way to allocate owners and to see which processes a disruption would take offline.
02Why it matters
The classification stops the map from becoming a flat list. It also helps a BCMS owner answer a resourcing question: core processes need named owners and exercise coverage, support processes need service levels, management processes need a calendar. And it shows which processes are themselves vulnerable in a disruption, which is a question the model should provoke.
03What good looks like
Draw three lanes and place every process. Name an owner per process and a deputy. Mark which processes would be affected by the loss of a site, a system or a supplier. Use the lanes in the management review so the report follows the same structure.
04Evidence an auditor asks for
Ask which support process would fail first in a disruption. If nobody has asked, the map is a diagram, not a model.
| Evidence | The record |
|---|---|
| Process map | A three-lane map with owners and deputies |
| Vulnerability | The processes affected by a site, system or supplier loss |
| Review structure | Management review reporting that follows the lanes |
05Where it commonly fails
- A flat process list with no owner
- Support processes omitted because they are not continuity-specific
- No view of which processes a disruption would take offline
06What to do before the estimate
Draw the three lanes with the twelve processes on this site. Add the owner and deputy for each.