What is emergency management?
Emergency management has two parts. Emergency preparedness (Notfallvorsorge) covers all preventive measures before a damaging event; emergency response (Notfallbewältigung) covers all activities after an emergency to reach a contingency mode, maintain it and return to normal operations. That is how the glossary to BSI Standard 200-4 defines them, and it translates "Business Continuity Management" as "Notfallmanagement".
BSI Standard 200-4 itself uses the term BCM; its change history lists the "change of the term Notfallmanagement to 'Business Continuity Management (BCM)'" (our translation). In contracts, questionnaires and audits, Notfallmanagement can therefore mean the whole of business continuity management or only the response. Clarify which scope is meant before you confirm a requirement.
Disruption, emergency, crisis: where is the line?
| Event | Definition in the BSI glossary to 200-4 | Handling |
|---|---|---|
| Disruption (Störung) | processes or resources are not available or working as intended | in normal operations, through fault resolution or incident management |
| Emergency (Notfall) | at least one time-critical business process is interrupted and cannot be restored in normal operations within the maximum tolerable period of disruption; the threat of an interruption is enough | special organisational structure (BAO) with existing or adaptable plans |
| Crisis (Krise) | massive negative impact that normal operations cannot handle, without suitable emergency plans | crisis management |
Decide in advance who declares an emergency, and name a deputy. The criteria should be usable without lengthy assessment, for example outage duration, affected processes, foreseeable damage, external impact and triggered reporting duties.
Who leads in an emergency? The special organisational structure
In an emergency, a special organisational structure (besondere Aufbauorganisation, BAO) steps in alongside the line: a temporary form of organisation with its own responsibilities, hierarchies and communication and decision paths. It includes a named lead, a crisis team with a minute-taker, people responsible for internal and external communication, and specialists, for example for IT, operations, legal and HR. Plan every core role with a deputy and check the contact lists in every exercise.
Worked example: how much time is left for recovery?
BSI Standard 200-4 calls the period from detecting and alerting through convening the BAO and deciding up to declaring the emergency the BAO response time. The recovery time objective (RTO) only starts when the emergency is declared; the BAO response time is therefore subtracted from the maximum tolerable period of disruption (MTPD), optionally with a buffer. The standard recommends setting the BAO response time centrally and refining it in alerting exercises.
Fictional example; the times are invented for illustration:
| Value | Time |
|---|---|
| MTPD of the order processing process | 8 hours |
| BAO response time, measured in the last alerting exercise | 2.5 hours |
| Buffer | 0.5 hours |
| RTO: 8 − 2.5 − 0.5 | 5 hours |
| Actual recovery time of the ERP system in the recovery test | 6 hours |
The one-hour gap needs a decision: shorten the BAO response time, for example with an on-call role that has authority to decide, or speed up recovery, for example with a prepared standby system. Without either, the MTPD will be exceeded in an emergency. The entry on business impact analysis explains how the MTPD and recovery times are determined.
What goes into the emergency manual, and how does alerting work?
According to the BSI glossary, the emergency manual (Notfallhandbuch) contains all information needed for emergency response, such as the emergency plans, the crisis team's rules of procedure and the communication concept. The emergency plans include business continuity, restart and recovery plans. Keep the manual available independently of the systems whose failure it covers.
The reporting path has to work in both directions: from detection to decision, and from decision back to those affected. It needs a contact point reachable at all times, escalation levels, an alternative communication channel in case your own IT is affected, and a log from the first report. The reports to supervisors, customers and insurers are built from that log.
What do the BSI Act and the NIS2 implementing regulation require?
Under § 30(2) sentence 2 no. 3 BSIG, particularly important entities (besonders wichtige Einrichtungen; "essential entities" in the NIS2 Directive) and important entities must provide for business continuity, "such as backup management and disaster recovery, and crisis management" (our translation). As a rule, § 30 does not apply to operators of public telecommunications networks or providers of publicly available telecommunications services (§ 28(5) BSIG). The same applies to energy companies subject to §§ 5c to 5e of the German Energy Industry Act (EnWG) and, under § 28(6) BSIG, to financial entities under DORA.
For entities of the types listed in § 30(3) BSIG, such as cloud computing service providers, point 4.1 of the Annex to Implementing Regulation (EU) 2024/2690 is specific. The business continuity and disaster recovery plan includes, where appropriate, roles and responsibilities, key contacts and communication channels, conditions for plan activation and deactivation, the order of recovery and recovery objectives, among other items. It is tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The guide Implementing an ISMS shows how emergency management fits into an ISMS, and the business continuity guide how to build a BCM.
IT disaster recovery is one part of it
IT disaster recovery and restart plans for systems cover one part. The business process remains the yardstick. A recovery test can bring the systems back in time while the process stays down, because access rights do not work, the business unit cannot be reached or a service provider was not involved. Exercise the process, therefore, not only the system restart.
Emergency management in Rizzqo
In Rizzqo, you link your processes and services to what they depend on, such as an IT system, a network or a provider's service. Before an emergency, you see which processes depend on a given system or provider. The requirements of frameworks such as ISO 27002 apply to these resources, and measures from an emergency exercise run as tasks that sync both ways with Jira.