BCP Core overview

BCP Core is operational business continuity for people and premises. It watches the hazards your company faces, warns staff before a hazard arrives, carries the BCP head’s order to every phone at once, collects each person’s status, and runs the call tree until everyone is accounted for.

BCP Core is the business continuity module of Risk Core, sharing one core with ERM Core: one organisation structure, one account per person, one action register and one audit log. It covers the part of ISO 22301 that IT disaster recovery does not: where your people are, whether they are safe, whether they can work, and who has not been reached.

Phone-first. Staff add BCP Core to their phone’s home screen from the browser — nothing to install from an app store — and allow notifications. The BCP head, the operator, HR and executives use the same app on a phone or at a desk.

One incident from first signal to follow-up. The system notifies and escalates; the BCP head decides.

What it covers

Area	What it does	Pages
Hazard watch and early warning	Live feeds for the hazards your company faces, each with its source and time; preventive warnings pushed before a hazard arrives	Hazard page and early warning
BCP level and command	Normal · Standby · Activated · Closed, ordered by the BCP head, entered by the BCP head or a named operator, pushed to every phone	BCP levels · Command and operation
Check-in and status	Safe / affected / need help with optional location, note and photo; work status for the day; team, line and company views	Check-in · Work status · Team and unit status
Map and routes	Hazard map, company sites and assembly points; routes that avoid the hazard layer	Map and route
Call tree and group chat	A call tree generated from the organisation structure, automatic escalation, team and incident rooms	Team room and call tree · Activating the call tree
After the incident	Closing creates a draft loss event in ERM Core; the incident timeline is exported; exercises are logged	Closing an incident · Exercise log
Public CSR path	A no-login public page for a specific hazard, collecting no personal data	Public CSR path

Hazards. The hazard set is configured per company: flood, storm and extreme weather, earthquake, air quality and haze, public-health events, civil unrest and social disruption. The app switches scenario without a rebuild, and each scenario carries its own guides and official links.

Worked example: a flood

A company’s head office sits in a low-lying district. This is how one flood runs in BCP Core.

1. The evening before. The hazard page shows heavy rain forecast for tomorrow and the river near its bank, each figure with its source and time. The values reach the company’s warning criteria, and every staff phone receives a preventive warning: prepare to work from home tomorrow, and avoid the river road.
2. The BCP head orders Standby. The operator, already activated for this hazard, enters Standby with the note “Rain and river level at warning criteria; prepare to work from home.” Every staff phone is told at once. Check-in opens.
3. Staff check in. Each person taps Safe, Affected or Need help, may share their location for that check-in and add a note or a photo, and sets their work status for the day — most choose working from home.
4. Team heads follow up. Each team head sees who has not reported and who needs help. HR sees the whole company; executives see their line without the sensitive detail.
5. Water enters the district. The BCP head orders Activated. The push goes to every phone, and the call tree activates: every node is asked to report in, critical activities from the BIA are reached first, and anyone not reached is escalated one level up. The BCP head watches coverage: reached, pending, escalated.
6. People who must move. Staff who need to reach an assembly point or get home use route guidance, which avoids the flooded area and hands off to Google Maps or Apple Maps.
7. The water recedes. The BCP head lowers the level to Standby, then orders Closed. Closing creates a draft loss event in ERM Core for the Entity Risk Manager to complete, and the incident timeline — from the first warning to the close — is exported for the post-incident review.
8. Afterwards. The lessons become action items, the hazard’s BCP levels are already in ERM Core as KRI observations, and the next call-tree drill is logged in the exercise log.

Who uses it

Persona	Starts at
Every employee	For employees
Team head, line executive, HR	Team and unit status
BCP head and operator	For the BCP head and operator
Client administrator	Public CSR path

Who may do what is set out in Roles and permissions. Everyone signs in with the same account used for ERM Core — see Signing in.

How BCP Core works with ERM Core

• BIA in, not maintained here. BCP Core reads the BIA approved in ERM Core — critical activities, RTO and minimum staffing — for call-tree priority, work-status planning and exercises.
• Incident to loss event. Closing an incident creates a draft loss event without re-keying. See Closing an incident.
• BCP level to KRI. Each hazard’s BCP level is recorded as a KRI observation. See External KRIs from BCP Core.
• One action register. Exercise findings and incident lessons land in the same register as every other action.

BCP Core is built to serve ISO 22301 — plans and procedures (cl. 8.4) and the exercise programme (cl. 8.5). See Standards mapping.

Pages in this section

ID	Page	For
C1	BCP Core overview	everyone
C2	For employees	staff
C2.1	Install and notifications	staff
C2.2	Check-in	staff
C2.3	Work status	staff
C2.4	Hazard page and early warning	staff
C2.5	Map and route	staff
C2.6	Team room and call tree	staff
C3.1	Team and unit status	team head, line executive, HR
C4	For the BCP head and operator	BCP head, operator
C4.1	BCP levels	BCP head, operator
C4.2	Command and operation	BCP head, operator
C4.3	Activating the call tree	BCP head, operator
C4.4	Announcements and group advisory	BCP head
C4.5	Closing an incident	BCP head
C4.6	Exercise log	BCP head, Entity Risk Manager
C5	Public CSR path	client administrator