What does BSI-Standard 200-4 cover?
BSI-Standard 200-4, published by the Federal Office for Information Security (BSI), describes how an organisation makes sure that time-critical business processes keep running or restart in time when staff, buildings, IT or service providers fail. It replaces BSI-Standard 100-4 on emergency management. The version to apply is 1.0 of May 2023. The starting point is the business processes; an IT recovery plan is one of the results of business continuity management.
As a BSI standard it is not legally binding. It is one way to meet business continuity duties, such as business continuity under § 30(2) sentence 2 no. 3 of the BSI Act (BSIG) for particularly important and important entities in Germany. Under § 28(6) BSIG, § 30 does not apply to financial entities under DORA, for which Article 11 DORA governs continuity. Under § 28(5) it does not in principle apply to telecommunications providers or to energy installations subject to §§ 5c to 5e EnWG.
How a BCMS is built step by step is covered in the guide building a BCMS.
The stage model: three stages
The standard provides three stages.
| Stage | Scope | Purpose |
|---|---|---|
| Reactive BCMS (Reaktiv-BCMS) | selected time-critical business processes and resources only, secured with existing means or minor investment | being able to respond to emergencies quickly; a much simplified entry stage to be developed into a build-up or standard BCMS after one BCM cycle |
| Build-up BCMS (Aufbau-BCMS) | a limited scope of business processes, chosen to include as many of the most time-critical ones as possible | entry with limited resources |
| Standard BCMS (Standard-BCMS) | all business processes in scope | complete BCMS; according to the standard, conformant with ISO 22301:2019 |
The business impact analysis metrics
The business impact analysis determines which business processes are time-critical and how quickly their resources must be available again. The standard uses these metrics:
| Metric | German term | Meaning |
|---|---|---|
| MTPD | maximal tolerierbare Ausfallzeit (MTA) | how long a business process may be down at most before intolerable impacts occur |
| RTO | geforderte Wiederanlaufzeit (WAZ) | period from declaring the emergency to the required start of the continuity solution; for processes and resources |
| RPO | maximal zulässiger Datenverlust | how old available data may be at most; the backup cycle follows from it |
| MBCO | Notbetriebsniveau | how capable the emergency operation should be |
| RTA | tatsächliche Wiederanlaufzeit | the actually achievable period from declaring the emergency to a productive continuity solution for a resource |
Under the standard, the RTO must be shorter than the MTPD, because the reaction time until the emergency is declared is deducted from the MTPD. This BAO reaction time runs from detection and alerting through the convening of the special emergency organisation (BAO) to the decision; the standard recommends setting it centrally and planning a time buffer.
Worked example: required and actual recovery time
Fictional example: the figures are invented for illustration. A wholesaler's order intake may be down for 24 hours at most (MTPD). The BAO reaction time is set centrally at 4 hours, the buffer at 2 hours.
| Step | Calculation | Result |
|---|---|---|
| RTO of the process | 24 h − 4 h reaction time − 2 h buffer | 18 h at most |
| RTO of the ERP system resource | same as the process requirement | 18 h at most |
| RTA of the ERP system | measured in the last recovery exercise: restore and test | 22 h |
| Gap analysis | 22 h RTA against 18 h RTO | gap of 4 h |
The gap is a decision for management. It can reduce the RTA, for example with a standby environment that does not have to be built first, or plan an emergency operation without the ERP that carries order intake for the difference. If several processes use the same system, the system must meet the shortest RTO of all dependent processes. Where no exercise results exist yet, the standard allows a knowledgeable person to estimate the RTA realistically; replace the estimate with a value measured in an exercise as soon as one exists.
Relationship to ISO 22301 and certification
According to the standard, the standard BCMS is conformant with ISO 22301:2019; with a fully implemented standard BCMS, an organisation can reach the maturity for certification under ISO 22301. A requirements catalogue with all MUST and SHOULD requirements of the standard BCMS includes a mapping to ISO 22301:2019 for this purpose.
According to the BSI's page about the standard, certification against BSI-Standard 200-4 itself is not yet planned (as of October 2026). Certification is against ISO 22301.
The standard can be introduced without an ISMS. Where one exists, the process and asset inventory and the availability rating provide direct inputs to the business impact analysis. How an ISMS is built is covered in the guide implementing an ISMS.