Maintain Business Continuity Management

Purpose

Translate the CBCS business continuity guidance into a testable BCMS requirement for continuity planning, testing and review.

Normative

Bitkaya shall maintain a business continuity management program that evaluates the operating context, establishes oversight, performs business impact analysis and risk assessment, prepares continuity plans, trains staff, tests plans, reviews them periodically and audits the program.

Descriptive

This requirement captures the BCM principles on context, oversight, business impact analysis, continuity planning, training, testing, review and audit.

Source reference: Provisions and Guidelines for Business Continuity Management.

Assurance Assertions

• Business continuity plans are prepared and approved.
• RTO and RPO expectations are identified for critical services.
• BCM testing and periodic review are documented.

Relationships

• Source: SRC-IT-001 CBCS IT Governance, Security, Continuity and Testing Guidelines
• Policies: POL-IT-001 IT and Cybersecurity Manual, POL-BCM-001 Business Continuity Manual
• Processes: PRC-RSA-001 Resilience Systems and Assurance, PRC-RSA-001 Resilience Systems and Assurance
• Procedures: PROC-IT-006 Maintain Business Continuity Management and PROC-BCM-001 through PROC-BCM-007
• Controls: CTRL-IT-006 Ensure Business Continuity Management Is Maintained and CTRL-BCM-001 through CTRL-BCM-007
• Systems: not yet assigned; tracked under ISS-OTC-001
• Publications: PUB-TRAIN-005 IT Compliance Training, PUB-OTC-001 Bitkaya Principal OTC Service Flows Memo

Assurance

• Source verified: yes
• Implementation linked: yes
• Wording unambiguous: review

History

• 2026-07-26: Created from SRC-IT-001.
• 2026-07-26: Linked to the IT process, procedure and control set.
• 2026-07-26: Added the missing IT policy metadata mapping.
• 2026-07-26: Linked the approved Business Continuity Manual and its detailed operating procedure and control set.