BCMS BIA & Plan Author

Business Continuity ISO 22301 BCMS BIA RTO RPO Compliance

Overview

Guided elaboration of BCMS documentation for ISO 22301: business impact analysis (BIA), risk assessment for disruption, continuity strategies, and BC/DR plans with RTO/RPO. Verifies critical activities have RTO/RPO and recovery options and flags missing dependency or SPOF notes.

Getting Started

Add your source materials to the project workspace, then activate the BCMS BIA & Plan Author skill. The agent will guide you through the process step by step.

Example Conversation

You: We’re updating our business continuity documentation for ISO 22301. I have a BIA with critical activities but not all have RTO/RPO and recovery options. We also want to document dependencies and single points of failure.
Agent: I’ll run check_bia_rtorpo on your BIA to see which critical activities have RTO/RPO and recovery content, and whether dependencies or SPOFs are mentioned. Then we can add the missing RTO/RPO and recovery options and a dependencies section.
Agent: The tool found BIA and critical activity content but reported that critical activities should have RTO and RPO defined, and that BIA should be linked to recovery options or continuity/DR plans. It also suggested documenting dependencies and SPOFs. I’ve added an RTO/RPO column to your critical activities table (e.g. Order processing: RTO 4 h, RPO 1 h) and a “Recovery option” column (e.g. “Failover to DR site; see BC plan section 4”). I’ve also added a “Dependencies / SPOF” section with a short table (activity, dependency, SPOF note).
You: Set RTO 24 h for our warehouse and add the supplier dependency.
Agent: Done. Re-run check_bia_rtorpo to confirm RTO/RPO and recovery options are complete and dependencies are documented.

Sample Output Excerpt

Excerpt from a BIA and BC plan: critical activities with RTO/RPO and recovery.

Critical activities and impact criteria (excerpt)

Activity	Impact criteria	RTO	RPO	Recovery option	Dependencies / SPOF
Order processing	Revenue; customer SLA	4 h	1 h	DR site failover; see BC plan §4	Single ERP; SPOF – see DR plan
Warehouse dispatch	Fulfilment delay	24 h	N/A	Manual backup; alternate carrier	Supplier X (packaging); dual source in progress
Payroll	Legal; staff	72 h	1 pay period	Outsourced backup; see BC plan §6	Payroll provider; contract includes BCP

Recovery options are detailed in the BC/DR plan. Dependencies and single points of failure are reviewed annually.

Built-in Validation Tools

The skill includes an extension tool that checks BIA and BC/DR documentation for RTO/RPO and recovery coverage.

What the tool checks

Check	`check_bia_rtorpo`
BIA section	Detects BIA, business impact, critical activity, 22301, RTO, RPO
RTO	Looks for RTO, recovery time objective, recovery time
RPO	Looks for RPO, recovery point, data loss, point in time
Recovery options	Looks for recovery option, recovery strategy, continuity plan, DR plan, BC plan
Dependencies / SPOF	Looks for dependency, single point of failure, SPOF, supplier, internal depend
Findings	WARNING if critical activities lack RTO/RPO or recovery options; INFO if BIA lacks dependency/SPOF or when RTO/RPO and recovery are present

Example validation output

======================================================================
BCMS BIA RTO/RPO & RECOVERY REPORT
ISO 22301:2019
======================================================================
Document: docs/bia.md

--- FINDINGS ---
  [WARNING] Critical activities should have RTO (recovery time objective) and RPO (recovery point objective) defined where applicable. Add RTO/RPO for each critical activity.
  [INFO] BIA should document dependencies (internal/external) and single points of failure (SPOF) where relevant. Add dependency and SPOF notes.

--- SUMMARY ---
  Errors: 0
  Warnings: 1
======================================================================

Run the tool on your BIA or BC/DR plan after drafting or updating.