Business Continuity Management Software Selection Guide

Navigate a mature market to find the best fit.

Analyst Perspective

This is a highly mature market with little to separate leading vendors when it comes to feature lists. Focus on usability and vendor support, and let price be the tiebreaker when the first two requirements are met.

Any decent business continuity management (BCM) software will have a business impact analysis (BIA) component, templates for developing plans, and the ability to integrate with other relevant software such as emergency/mass notification tools, human resource information system (HRIS) tools, and so on. To evaluate vendors and find the right fit for your organization, focus on usability because the feature lists are likely to look very similar. For usability, factor in not only the end-user perspective but also the ease of implementation, integration, and administration, particularly as BCM vendors continue to expand their offerings in real-time incident management and overall resilience planning (e.g. crisis management, operational resilience planning, and so on). With greater complexity comes greater need for usability. Vendor support to streamline implementation (including customizations), integrations, and administration is also critical, but harder to determine from a vendor’s response to an RFP or a demo. The Net Emotional Footprint in our SoftwareReviews reports can provide an indicator of what to expect, and drive questions to ask prospective vendors beyond feature considerations. Finally, usability is subjective. Use our SoftwareReviews scores as a guide to help shortlist vendors, but ultimately you need to see these products and ensure they meet your specific requirements. Usability in specific areas critical to your goals can tip the balance.

Frank Trovato Principal Advisory Director, Infrastructure and Operations Info-Tech Research Group

Executive Summary

Info-Tech Insight

All leading vendors in this space offer the same core features, so focus on usability, price, and differences in key features that are most relevant to your requirements.

Info-Tech’s methodology for selecting an appropriate BCM solution

Combine this research with our Rapid Application Selection Framework (RASF) to accelerate the process

Book a call with an analyst to help you with your software selection:

• Combine expert analyst guidance with the vendor analysis and tools in this blueprint.
• Follow a structured, efficient process using the RASF framework to identify your use cases and key requirements to find the best fit.
• Leverage our contract review services to level the playing field through the negotiation process.

Evaluate solutions
Determine the best fit for your needs by scoring against features.

Features
Determine which features will be key to your success.

Use Cases
Create use cases to ensure your needs are met as you evaluate features.

High-Level Requirements
Use the high-level requirements to determine use cases and shortlist vendors.

CLICK HERE to book your Selection Engagement

Phase 1

Understand BCM Software Capabilities and Trends

This phase will walk you through the following activities:

• Level set an understanding of what is BCM software.
• Define which BCM software features are table stakes (standard) and which are key differentiating functionalities.
• Review key trends in the BCM software market.

This phase involves the following participants:

• Business continuity manager (or whoever is taking on that role, if not a full-time role).
• GRC representative. The BCM solution will support overall GRC efforts.
• Other stakeholders who will be responsible for creating or maintaining BCM-related plans (e.g. IT DRP, BCP, Crisis Management Plan).

What exactly is BCM software?

BCM software supports the development and maintenance of an organization's BCP and related resilience plans. This includes features to facilitate core activities such as identifying business processes and dependencies, executing a BIA, and documenting incident response plans.

BCM software typically can be used to develop, maintain, and/or support a wide range of resilience plans and related objectives including, but not limited to:

• Business Continuity Plan (BCP)
• IT Disaster Recovery Plan (DRP)
• Emergency Response Plans (ERP)
• Crisis Management Plans (CMP)
• Governance, Risk, and Compliance (GRC)

Info-Tech Insight

BCM software offerings continue to expand, and the wide range of capabilities and types of plans they support can be overwhelming. Look for options to simplify the experience (e.g. entry-level software package or the ability to customize views to hide content that is not yet applicable) until you are ready to take full advantage of the solution.

BCM software table stakes

Effective BCM solutions streamline the development and maintenance of your BCP and related plans (e.g. DRP, crisis management). That starts with these core features:

Beyond table stakes

This is a mature market. Most leading vendors have these same features, but the usability and effectiveness can vary.

Incident Response Management

Facilitates response by identifying affected systems/business processes, relevant plans, and recovery status.

Visual Representation

Illustrates response workflows, dependency mapping, incident impact, etc.

Interface Customization

Customizes input forms, field labels, menu items, etc.

Role-Based Access and Views

Customizes views based on role to improve usability (only see what you need) and manage data security.

Data Encryption

Encrypts data in-flight (i.e. while it's being uploaded/entered) and at rest (after it's uploaded/entered).

Compliance Reporting

Creates predefined reports for common BCM standards (e.g. ISO 22301) and customizable reports to align with other standards.

Vendor Security Compliance

Complies with security standards such as FEDRAMP and SOC2

Integrations to facilitate automation

Seamless integrations to import data such as contact information and system dependencies streamline implementation and ongoing plan maintenance.

GRC Integration

Shares common information between your BCM tool and your overall GRC solution to streamline plan development and reporting.

Customized Integrations

Ensures flexibility to integrate with a wide range of products and not be limited to product-specific connectors.

Mass Notification Capability

Customizes mass notification to relevant groups (e.g. leadership, IT, users) via built-in capabilities or integration with EMNS products.

Roles and Users Information Management

Leverages HRIS, AD, or related systems to pre-populate and maintain user lists, contact info, department, location, etc.

ITSM Integration – Source Data

Leverages ITSM tools to identify systems and dependencies.

ITSM Integration – Critical Incident Management

Enables ITSM tool to leverage your BCM tool to coordinate and manage response (e.g. targeted notifications, incident tracking).

DR Orchestration Software Integration

Ensures alignment of system criticality, RTOs, and RPOs between the BCM tool and DR orchestration software.

Key trend – Operational resilience (OpRes)

OpRes planning improves day-to-day resilience for critical services as opposed to only preparing for traditional large-scale disruptions.

Future trend – AI streamlining BCM efforts

Organizations across all industries are scrambling to understand the potential and risks of AI, especially generative AI. The BCM market is no different. Examples of potential enhancements that we expect will be (or already are) part of BCM product roadmaps include:

• Generate plan summaries: A common challenge for BCM tools is generating a prose-style summary of the massive amount of data and planning captured within the tool, as opposed to provide what appears to be a database dump. AI is a potential solution to create a BCP summary aimed at executives, third-parties, and auditors to provide a high-level, concise, and readable summary of the current state of your BCM program.
• Generate recovery procedures: Similar to the above, leverage information in the tool (e.g. systems and dependencies) and from related sources to generate draft recovery procedures.
• Automate plan updates (beyond the basics): Existing automation will maintain contact and dependency information. AI or automation improvements can potentially identify more significant updates due to new service offerings, organizational changes, network changes, and so on.

Risks:

• Data security: Using third-party tools (e.g. ChatGPT) can expose your data. BCM vendors are addressing this by building their own AI solutions to enable control over data usage.
• Inaccuracies: AI is only as good as the data it can access and how it interprets that data. AI potentially provides a starting point to create draft content that still needs to be reviewed.
• AI treated as a silver bullet: Similar to the above, AI has the potential to streamline BCM efforts, not replace foundational BCM practices that ensure an effective and accurate overall BCM program.

A BCM solution supports a sound BCM process; it does not replace it

There are many BCM process frameworks; at its core, it comes down to these three activities – with governance oversight and support by relevant technology (which can include a BCM solution):

• Define Requirements: Determine scope (business functions, locations, legal and regulatory requirements, etc.), recovery targets (e.g. RTOs, RPOs), and relevant organizational objectives.
  
• Implement: Create and implement incident response strategies, including people, process, and technology considerations.
  
• Maintain: Review and update requirements; test and update solutions; maintain governance oversight to keep the BCM program current and aligned with organizational objectives.

Phase 2

Define Your Requirements

This phase will walk you through the following activities:

• Identify requirements, with a focus on use cases to drive practical evaluation of prospective vendors.
• Complete the BCM Vendor Evaluation Workbook to document your requirements to support your evaluation process. This workbook can be used as a supplement to your RFP to drive detailed responses relevant to your requirements.

This phase involves the following participants:

• Business continuity manager (or whoever is taking on that role, if not a full-time role).
• GRC representative. The BCM solution will support overall GRC efforts.
• Other stakeholders who will be responsible for creating or maintaining BCM-related plans (e.g. IT DRP, BCP, Crisis Management Plan).

Elicit and prioritize requirements for your BCM solution

Understanding business needs through requirements gathering is key to defining everything about what is being purchased, yet it is an area where people often make critical mistakes.

Info-Tech Insight

Review Info-Tech’s requirements gathering methodology to improve your requirements gathering process.

Activity: Complete the vendor evaluation workbook

1. Review each tab of Info-Tech’s BCM Vendor Evaluation Workbook to ensure you have a good understanding of the different areas of evaluation.
2. As a team, collaborate to identify relevant use cases, technical requirements, qualifications, and implementation deliverables.
3. Modify the example criteria to suit your requirements. This would include adding, changing, and/or deleting criteria where appropriate for your needs.

Note: After you finalize the criteria in the workbook, you can choose to send the workbook to vendors to provide their responses or use your RFP and/or demos to collect the required information to complete the vendor responses.

Download the BCM Vendor Evaluation Workbook

Choose your route: RFP or otherwise?

As you gather requirements, decide which procurement route best suits your situation.

Phase 3

Select Your Vendor

This phase will walk you through the following activities:

• Review profiles of leading BCM software vendors, including representative customers, vendor history, and analyst insights.
  
• Follow a structured, efficient process to evaluate vendors to find the best fit.

This phase involves the following participants:

• Business continuity manager (or whoever is taking on that role, if not a full-time role).
  
• GRC representative. The BCM solution will support overall GRC efforts.
  
• Other stakeholders who will be responsible for creating or maintaining BCM-related plans (e.g. IT DRP, BCP, Crisis Management Plan).

Discover key players through our SoftwareReviews rankings and reports

	The Data Quadrant is a thorough evaluation and ranking of all software in an individual category to compare platforms across multiple dimensions. Vendors are ranked by their Composite Score, based on individual feature evaluations, user satisfaction rankings, vendor capability comparisons, and likeliness to recommend the platform.
	The Emotional Footprint is a powerful indicator of overall user sentiment toward the relationship with the vendor, capturing data across five dimensions. Vendors are ranked by their Customer Experience (CX) Score, which combines the overall Emotional Footprint rating with a measure of the value delivered by the solution.

Leading BCM Solutions

Product summaries driven by SoftwareReviews and analyst insights.

The vendors profiled in this section are listed below, in order of their SoftwareReviews ranking as of November 2023.

This is a mature market, which makes for a crowded leaderboard. Although some products rank higher than others, all the products profiled in this report are among the leaders in this market and are worthy of consideration. The key is to find the right fit for your requirements.

Also note that this is not an exhaustive list. Several well-known vendors such as Archer and Quantivate are not listed here due to insufficient recent reviews to make a fair comparison.

Use the profiles in this section along with our BCM SoftwareReviews reports to help you determine the best fit.

For the latest scores as well as the downloadable category and product reports, please see SoftwareReviews' BCM category.