# BCMS BIA & Plan Author

> Guided elaboration of BCMS documentation for ISO 22301: scope and context (Clause 4), BC policy (Clause 5), risk assessment for disruption (Clause 8.3), business impact analysis with MTPD/MBCO/RTO/RPO (Clause 8.4), continuity strategies and BC/DR plans, and plan testing and exercising (Clause 8.5). Validates that critical activities have MTPD, MBCO, and RTO defined; checks RPO for IT/data-dependent activities; and flags missing dependency or SPOF notes.



Tags: Business Continuity, ISO 22301, BCMS, BIA, RTO, RPO, MTPD, MBCO, Compliance


## Example Prompts

- Conduct BIA and define MTPD, MBCO, and RTO/RPO for our critical activities
- Draft our BC/DR plan structure per ISO 22301
- Check that critical activities have MTPD, MBCO, RTO/RPO and recovery options and dependencies are documented

URL: https://rakenne.app/skills/bcms-bia-plan-author/index.md

Try this skill: https://rakenne.app/a/?skill=bcms-bia-plan-author


## Overview

Guided elaboration of BCMS documentation for ISO 22301: business impact analysis (BIA), risk assessment for disruption, continuity strategies, and BC/DR plans with RTO/RPO. Verifies critical activities have RTO/RPO and recovery options and flags missing dependency or SPOF notes.

## Getting Started

Add your source materials to the project workspace, then activate the *BCMS BIA & Plan Author* skill. The agent will guide you through the process step by step.

## Example Conversation

> **You:** We're updating our business continuity documentation for ISO 22301. I have a BIA with critical activities but not all have RTO/RPO and recovery options. We also want to document dependencies and single points of failure.
>
> **Agent:** I'll run `check_bia_rtorpo` on your BIA to see which critical activities have RTO/RPO and recovery content, and whether dependencies or SPOFs are mentioned. Then we can add the missing RTO/RPO and recovery options and a dependencies section.
>
> **Agent:** The tool found BIA and critical activity content but reported that critical activities should have RTO and RPO defined, and that BIA should be linked to recovery options or continuity/DR plans. It also suggested documenting dependencies and SPOFs. I've added an RTO/RPO column to your critical activities table (e.g. Order processing: RTO 4 h, RPO 1 h) and a "Recovery option" column (e.g. "Failover to DR site; see BC plan section 4"). I've also added a "Dependencies / SPOF" section with a short table (activity, dependency, SPOF note).
>
> **You:** Set RTO 24 h for our warehouse and add the supplier dependency.
>
> **Agent:** Done. Re-run `check_bia_rtorpo` to confirm RTO/RPO and recovery options are complete and dependencies are documented.

## Sample Output Excerpt

Excerpt from a BIA and BC plan: critical activities with RTO/RPO and recovery.

---

### Critical activities and impact criteria (excerpt)

| Activity | Impact criteria | RTO | RPO | Recovery option | Dependencies / SPOF |
|----------|-----------------|-----|-----|-----------------|---------------------|
| Order processing | Revenue; customer SLA | 4 h | 1 h | DR site failover; see BC plan §4 | Single ERP; SPOF – see DR plan |
| Warehouse dispatch | Fulfilment delay | 24 h | N/A | Manual backup; alternate carrier | Supplier X (packaging); dual source in progress |
| Payroll | Legal; staff | 72 h | 1 pay period | Outsourced backup; see BC plan §6 | Payroll provider; contract includes BCP |

*Recovery options* are detailed in the BC/DR plan. Dependencies and single points of failure are reviewed annually.

---

## Built-in Validation Tools

The skill includes an extension tool that checks BIA and BC/DR documentation for RTO/RPO and recovery coverage.

### What the tool checks

| Check | `check_bia_rtorpo` |
|-------|:------------------:|
| **BIA section** | Detects BIA, business impact, critical activity, 22301, RTO, RPO |
| **RTO** | Looks for RTO, recovery time objective, recovery time |
| **RPO** | Looks for RPO, recovery point, data loss, point in time |
| **Recovery options** | Looks for recovery option, recovery strategy, continuity plan, DR plan, BC plan |
| **Dependencies / SPOF** | Looks for dependency, single point of failure, SPOF, supplier, internal depend |
| **Findings** | WARNING if critical activities lack RTO/RPO or recovery options; INFO if BIA lacks dependency/SPOF or when RTO/RPO and recovery are present |

### Example validation output

```
======================================================================
BCMS BIA RTO/RPO & RECOVERY REPORT
ISO 22301:2019
======================================================================
Document: docs/bia.md

--- FINDINGS ---
  [WARNING] Critical activities should have RTO (recovery time objective) and RPO (recovery point objective) defined where applicable. Add RTO/RPO for each critical activity.
  [INFO] BIA should document dependencies (internal/external) and single points of failure (SPOF) where relevant. Add dependency and SPOF notes.

--- SUMMARY ---
  Errors: 0
  Warnings: 1
======================================================================
```

Run the tool on your BIA or BC/DR plan after drafting or updating.


---

Back to [Skill Library](https://rakenne.app/skills/index.md)