BCM Maturity Model

Where does your resilience stand?

A maturity model describes how developed an organisation’s business continuity programme is, as a staged journey from improvising during disruption to continually improving.

A staged journey from improvised response to continual improvement.

A maturity model describes how developed an organisation’s business continuity programme is. It presents that development as a staged journey: at the start an organisation improvises when disruption strikes, and at the end business continuity is continually improving, tested and embedded in the culture. Most organisations sit somewhere in between, with different parts of the business at different stages.

From improvising to continually improving.

01

Improvised

There is no formal programme, and the organisation responds to disruption as it happens.

  • No documented continuity plans or defined roles
  • Response depends on individuals acting on the day
  • Recovery time is whatever the disruption allows
02

Aware

Some awareness of continuity exists, but nothing documented that the organisation can rely on.

  • Interest at individual level, no executive mandate
  • Reliance on a few key individuals who “know how things work”
  • No documented plans to guide a response
03

Foundations in place

The first formal pieces of a programme exist and a team owns them.

  • A first business impact analysis identifies critical activities
  • A high-level continuity plan exists on paper
  • A named team is responsible, though testing is limited
04

Established and tested

The programme is documented, aligned to recognised standards and exercised regularly.

  • A documented programme aligned to recognised standards
  • A comprehensive BIA with recovery time and recovery point objectives
  • Detailed scenario plans, exercised and tested on a regular schedule
05

Continually improving

Lessons from incidents and exercises feed directly into a stronger programme.

  • Improvement actions from incidents and exercises are tracked through
  • Business continuity is integrated with risk management
  • Ongoing training and awareness build a culture of resilience

Five honest questions.

Read one question per stage. Where your honest answer turns from “no” to “mostly” is roughly where your programme sits today. This is a plain self-check, not a scored assessment.

  1. Improvised: if a major disruption hit tomorrow, would the response be improvised on the day?
  2. Aware: do people talk about continuity, but nothing documented guides a response?
  3. Foundations: is there a first BIA, a high-level plan and a named team that owns it?
  4. Established: is the programme documented to a recognised standard, with detailed plans that are exercised regularly?
  5. Improving: do lessons from incidents and exercises feed measurable improvements, integrated with risk management?

Move up the stages with ADOX.

BC maturity and improvement

Maturity and improvement recommendations that point to the next stage for your programme.

Reviews, audits and benchmarking

Business continuity and operational resilience management reviews, audits, assessments and benchmarking.

Programme framework review

A review of your business continuity programme framework and methodologies.

Reporting dashboards

BC implementation reporting dashboards to monitor preparedness levels.

BC exercises

Customised incident scenarios, continuity exercises and tests.

Aligned standards

Work aligned with ISO 22301, UAE NCEMA 7000 and the BCI Good Practice Guidelines (GPG 7.0).

Find out where your organisation stands.

We aim to reply to your enquiry within 2 hours.

Built with Symphony.co