Organizational resilience
Resilience and business continuity (BCMS).
We design, implement and maintain Business Continuity Management Systems aligned with ISO 22301, so the organization keeps delivering its critical products and services through technological, operational, natural or third-party disruptions and meets the expectations of regulators, customers and the board.
What it includes
Assessment and scope
Maturity assessment against ISO 22301 and applicable regulatory requirements; definition of scope, context, interested parties and a continuity policy approved by top management.
Business impact analysis (BIA)
Identification of critical processes, products and services; recovery time objectives (RTO), recovery point objectives (RPO) and minimum business continuity objectives (MBCO); dependencies on people, technology, facilities, information and suppliers.
Disruption risk assessment
Threat and disruption scenario analysis with a methodology aligned with ISO 31000; risk prioritization and definition of reduction, preparedness and transfer measures.
Continuity strategies and solutions
Selection of recovery strategies per resource (alternate sites, technology redundancy, key personnel, alternate suppliers) with cost-benefit analysis and an implementation plan.
Continuity and recovery plans
Incident response structure, crisis management and communication plan, business continuity plans (BCP) per process and IT disaster recovery plan (DRP), with roles, procedures and checklists.
Exercises, testing and continual improvement
Exercise program (tabletop, simulation, technical and alternate-site tests), evaluation of results, performance indicators, internal audit, management review and corrective actions to keep the system current.
Five-phase methodology
A cycle aligned with the high-level structure of ISO management system standards (plan, do, check, act).
1. Understand
Context, legal and regulatory requirements, scope and policy.
2. Analyze
BIA, risk assessment and continuity requirements per resource.
3. Design
Strategies, solutions and response structure.
4. Implement
Plans, procedures, training and awareness.
5. Validate
Exercises, internal audit, management review and certification.
Outcomes for the organization
Assured operations
Demonstrable capability to recover critical processes within the time frames defined by the business.
Regulatory compliance
Organized evidence for CNBV, Banxico, INDEVAL, SWIFT and external auditors.
Market confidence
ISO 22301 certification as a differentiator before customers, the board and rating agencies.
Reference frameworks and requirements
- ISO 22301
- ISO 22313
- ISO 22317 (BIA)
- ISO 31000
- ISO/IEC 27031
- CNBV Single Banking Circular
- Banxico provisions
- INDEVAL requirements
- SWIFT CSP
Related services
Information security (ISMS)
ISO/IEC 27001: governance, risk, controls and certification.
See service →Audit and regulatory compliance
CNBV, BANXICO, SOX, SOC 2 Type 2, PCI DSS and INDEVAL.
See service →Financial sector
Regulatory compliance and security for banks, electronic payment fund institutions, brokerage houses, insurers and pension fund managers.
See service →Shall we talk?
A managing partner will attend you personally. Free 30-minute executive assessment, in person or online.