Exploring a Multidisciplinary Assessment of Organisational Maturity in Business Continuity: A Perspective and Future Research Outlook

Abstract

In a competitive business landscape heavily reliant on information and communication technology, organisations must be prepared to address disruptions in their business operations. Business continuity management involves effective planning for the swift reestablishment of business processes in the short term. However, there are still obstacles to implementing business continuity plans, which can be justified by various factors. The purpose of this study is to present the perspectives and future research paths based on a systematic literature review from the peer-reviewed literature published from 1 January 2000 to 31 December 2021. This systematic literature review adheres to the guidelines established by evidence-based software engineering and leverages the Parsifal online tool. The primary research results identify and establish connections between the common components and activities of business continuity management as defined in international standards and frameworks to identify gaps in the existing knowledge. These findings will contribute to the development of a framework that provides a practical approach applicable to organisations of all sizes, taking into account each aspect of business continuity management, with a particular emphasis on information and communication technology systems. This paper’s contribution lies in offering insights from a systematic literature review regarding the strategic principles for designing and implementing a business continuity plan, along with a comprehensive overview of related research. Furthermore, it presents a path forward to guide future research efforts aimed at addressing the gaps in the literature concerning continuity planning.

1. Introduction

In today’s volatile, uncertain, complex, and ambiguous (VUCA) business landscape, the need for robust business continuity management (BCM) has never been more pronounced. Organisations grapple with constant disruptions, especially those linked to information and communication technology (ICT). This research endeavours to bridge the existing gaps in understanding how ICT intertwines with BCM, acknowledging the pivotal role technology plays in modern business operations. In this regard, organisations must be ready to address disruptions in their business processes, particularly those reliant on ICT services. Their significance emerges as a critical thread throughout the research.

It is imperative to underscore that the level of organisational maturity plays a pivotal role in determining the efficacy of business continuity planning (BCP) [1]. While the discussion naturally gravitates towards addressing disruptions in business processes reliant on ICT services, it is crucial to recognise that organisational maturity is not merely incidental, but a fundamental aspect that significantly influences the success of BCP implementation [2].

Business continuity (BC) refers to an organisation’s ability to strategically and tactically plan for and respond to business incidents and disruptions [3], ensuring that business operations can be maintained at an acceptable level. Consequently, a BCP is crafted to prevent or mitigate risks, minimise the consequences of crises or disasters, and reduce the timeframe required to return operations to a normal state [4].

In this context, it is relevant to delve into the symbiotic relationship between BCM and organisational resilience. As businesses face unprecedented challenges, the integration of BCM becomes a strategic imperative for not only surviving but thriving in the face of adversity. By exploring the intersections of BCM, resilience, and change management, this research seeks to provide a comprehensive framework that goes beyond mitigating risks to fostering adaptive capacity in organisations.

Nevertheless, some organisations defer or undervalue BCP implementation. To address constraint mitigation in BCP implementation, it is relevant to review the literature in the BC area in search of strategic guidelines that allow for streamlining of the design and implementation of BCP.

Strategy is the long-term approach to implementing a firm’s business plans to achieve its mission [5]. Developing a BCM strategy should reflect and support mission achievement, organisational strategy, and the tactics to define relevant actions and ensure that the business leaders support them.

The decision-making strategies reflect each decision-maker’s experience and can limit the suboptimisation of overall enterprise goals [6]. Therefore, to implement a BCP, there is a need to introduce the BCP activities and acquire organisational capability for conducting BCP actions as planned [7]. The creation of BC teams must be considered to achieve the organisational capability and a comprehensive BCP. Among other tasks, the definition of roles and responsibilities for persons and teams with authority, during and after an incident, is relevant to the organisation [8].

An essential element for achieving success in the development of a business continuity management (BCM) strategy involves establishing performance metrics to pinpoint the minimum operational service thresholds [5]. Knowing the predefined thresholds that can lead to activating the response is relevant [9]. Furthermore, it is equally crucial to consider metrics that underpin the assessment of business value and the validation of project success [10]. Therefore, organisations can benefit from this achievement and the existence of a guiding framework for activities aimed at mitigating business disruptions when designing BCP and the BCM program [11].

The primary aim of this work is to provide a comprehensive overview and a path forward in research related to BCM, based on the results of the systematic literature review (SLR) accomplished as part of the design science research (DSR) methodology adopted. A technical presentation of the SLR is relevant to provide a methodological and scientific basis. It also presents the most relevant decisions and constraints in the review process to provide an answer path for the research question and alternative research paths that can be followed.

This paper is organised into the following sections after introducing the problem: the first section highlights the motivation for the research and identifies the problem. The second section describes the research methodology, and the third section presents the search strategy applied. The SLR results are quantified in the fourth section. The discussion on the results and a path forward appear in the fifth section. Finally, we present the conclusions, followed by a list of all the bibliographical references used.

2. Research Motivation

Organisations have the flexibility to choose from a variety of international standards and frameworks (ISFs) to steer the design, execution, and upkeep of their BC solutions. Various viewpoints on BCM, as outlined by the most commonly employed frameworks, establish a set of requisites, practices, or activities designed to oversee the components of BC.

Certain organisations postpone the implementation of their BCP, citing reasons such as design limitations, which may be attributed to technical or financial constraints or issues related to the interpretation of requirements [12], or limitations imposed by company policies and project timelines [13]. Hence, there exists a shortfall within organisations that have adopted and obtained certification in BCM standards, especially in the public sector [14]. Small or medium-sized enterprises (SMEs) are more susceptible to disasters due to their limited financial and human resources and poor technological capabilities to recover from disasters [15]. Other constraints felt in organisations are the lack of proactivity in BC planning and disaster recovery (DR) [16] that can lead to damage to reputation and market share, failure in customer service and business processes, regulatory responsibility, and increases in the system resume and restore times.

These limitations highlight a perceived level of complexity when it comes to launching a BCM program and the essential expertise required for crafting and executing a BCP [17], as well as its ongoing maintenance.

To address the challenges associated with constraint mitigation, it is essential to gain a comprehensive understanding of each identified component within the business continuity management system (BCMS). Additionally, it is crucial to review research findings that may uncover a broader range of constraints and strategic guidelines aimed at optimising the implementation of BCPs.

2.1. International Standards and Frameworks

The International Organisation for Standardisation (ISO), in its ISO 22301:2019 standard, specifies requirements to implement, maintain, and improve a management system to protect against, reduce the likelihood of the occurrence of, prepare for, respond to, and recover from disruptions when they arise [9].

The Capability Maturity Model Integration (CMMI) v2.0 represents a collection of best practices that empower businesses to enhance their performance while also providing a framework for planning mitigation strategies to handle substantial disruptions in business operations [18].

In the BC scope, the primary goal of Control Objectives for Information and Related Technology (COBIT) 2019, a framework designed for the governance and management of enterprise ICT, is to furnish a strategy that allows both business and ICT organisations to effectively respond to incidents and swiftly adapt to disruptions [19].

The Information Technology Infrastructure Library (ITIL) 4, provides guidance to address service management challenges and utilise the potential of modern technology. It introduces service continuity management practices to guarantee the availability and performance of services in the event of a disaster [20].

The National Fire Protection Association (NFPA) 1600 standard establishes essential criteria for readiness and resilience through a program that encompasses prevention, mitigation, response, continuity, and recovery [21].

These frameworks are organised into activities, objectives, or practices that, when combined with their overarching vision, provide a structured approach to effectively address, guide, diminish, mitigate, manage, or respond to disasters, incidents, or disruptions in business operations or service delivery.

2.2. Problem Identification

To approach the constraint mitigation and identify areas to research, the ISFs were mapped and compared to identify areas not formally covered by those references. Figure 1 illustrates the initial gaps (depicted as red shapes) in the formal delineation of activities found in the primary BCM references for each BCM common component (located in the outer ring). Figure 1 presents the organised activities, objectives, or practices within the ISFs and highlights relevant components of BC within the circle’s centre.

The intention here is to emphasise that despite the complexity and relevance of the references we have reviewed, there appears to be an opportunity to address the gaps identified, particularly concerning the definition of BC metrics. While the standards’ guidance concentrates on the methods, timing, and parties responsible for measurement, they also underscore that organisations need to determine what exactly should be measured.

Score metrics can improve the planner’s involvement and the plan content [23]. They can also improve communication of the plan’s content and activities’ achievements and tendencies between the BC teams and the top management. They also can provide the ability to perform a quick assessment of the quality of the plan.

The definition of the BC teams is not formally addressed in most of the studied ISFs. ISO 22301:2019 states that the organisation needs one more teams responsible for responding to disruptions, with roles and responsibilities. Thus, the BCP must provide guidance and information to assist teams in responding to a disruption [9]. The other standards mention the BC teams as given facts, for example, by considering that the recovery phase must detail a suggested course of action for recovery teams to restore system operations [24].

The existence of BC teams, although relevant for the success of the BCM [25] and, for example, for the BCP exercises [26], is not necessary at all times [27]. Considering this information, this area of research was deferred. The other gaps are partial, considering that some ISFs address them and others do not, and therefore, not eligible to be considered an undervalued research path.

Acknowledging the ISF guidelines, the framework to be developed should also include the best practices and considerations stated in the literature for defining metrics that reveal a particular BC performance or program implementation. The SLR focuses on identifying frameworks, models, and other contributions that address the key areas of interest identified in this paper.

Taking into account the guidelines provided by the ISF, any BC framework should encompass the best practices and insights outlined in the literature for defining metrics that effectively showcase specific aspects of BC performance or program implementation. The research primarily concentrates on pinpointing frameworks, models, and other contributions that tackle the key areas of interest outlined in this paper.

3. Research Methods

Considering that the research aims to develop a new framework, DSR is an appropriate research methodology for the specificity of the problem, in accordance with the model introduced by Peffers et al. [28]. It contributes to complex organisational problem resolution [29] and produces knowledge for model design [30].

Within the context of DSR, the identification of the problem informs the formulation of the solution’s objectives. In this step, we have incorporated the SLR methodology to refine the objectives of the artefact. This combination ensures rigour across the DSR process model steps [28].

An SLR is a means of identifying, evaluating and interpreting all available research relevant to a particular research question, topic area, or phenomenon of interest. Undertaking an SLR following a predefined search strategy allows the completeness of the search to be assessed. Therefore, an SLR can identify and report research that does not support the preferred research hypothesis and identify and report research that supports it [31]. Thus, an SLR can provide the basis for knowledge development and support new paths in a particular field [32]. The SLR results can be synthesised from a different perspective, like a semi-SLR, providing an agenda for further research.

3.1. Objectives for a Solution

The focus of this ongoing study revolves around the multidisciplinary preparation of an organisation’s response to attain a predetermined level of business process continuity during various phases of incidents or disruptive events in daily operations.

The primary aim is to propose, create, and validate a framework that, through a multidisciplinary assessment of organisational maturity in the BC domain, will provide guidance for the development and analysis of crucial elements required for formulating a BCP, with a particular emphasis on ICT systems. A specific objective is to identify and correlate the components and activities of BCM within ISFs, in order to pinpoint gaps and establish a comprehensive framework that offers a holistic perspective on BCP implementation.

The research process integrates the SLR, intending to define the essential components that allow a practical and effective BCP formulation tailored to the unique characteristics of organisations. It is intended to evaluate the relevance and pertinence of each of the activities identified and defined in the components of the BCM to streamline the BCP design and implementation.

3.2. Research Question

One of the most important activities in the protocol is the formulation of the research question, which should identify the existing basis for the work and make clear where the proposed research fits into the current body of knowledge [31]. Hence, the research questions are whether it is possible:

• to support an organisation and streamline its organisational processes,
• with the definition of strategic guidelines for implementing a BCP,
• which allows the formulation of response, restart, recovery, and restoration of business processes, supported by ICT,
• at a predefined level of operationality,
• according to the maturity and capacity of the organisation?

Four objectives are identified, underlying the research question, for creating the artefact that should allow the support and streamlining of organisational processes:

• What components should constitute a framework for implementing a business continuity plan?
• How comprehensive should the framework be to be usable in organisations?
• How to adapt the framework to the capacity and specificity of each organisation?
• How to assess the added value of using the framework in an organisation to measure how it supported and streamlined the design of the business continuity plan?

3.3. The Protocol and Tools

The SLR adheres to the principles outlined in evidence-based software engineering [31] and utilises the Parsifal online tool for assistance.

We employed the population, intervention, comparison, outcome, context (PICOC) protocol. The population affected by the intervention [31] is the organisations. The intervention tool or procedure under study [33] is the framework with “strategic guidelines for business continuity plan implementation”. The intervention will undergo a comparative assessment with other frameworks, and the expected outcome will be a way to “support and streamline organisational processes for defining strategic guidelines to the implementation of a business continuity plan, according to the maturity and capacity of the organisation”. The context or the extended view of the population [33] is “organisations with business processes supported by ICT”.

The keywords to be used in the search string are presented in

Table 1. Keywords and synonyms.

PICOC	Keyword	Synonym
Intervention I	business continuity plan	disaster recovery plan
Intervention II	guideline	guidance
		strategy
Comparison	framework	approach
		methodology
		procedure
		program
Outcome	streamline	agile, optimise, improve
		encourage, bolster, support
		boost, expedite, speed up, increase

.

Because the population (organisation, enterprise) is vast, it is excluded from the keywords and not presented in Table 1. The context can only be retrieved in the data extraction phase of the protocol.

Other synonyms were assessed, for example, “incident response”, “incident management”, “disaster response”, and “disaster resilience”, but the results pointed to areas not in the intervention or context definitions. The phrase “business continuity” or “disaster recovery” expands the results to broad areas, not focusing on strategic guidelines for planning.

3.4. Inclusion and Exclusion Criteria

The exclusion criteria are supported in the research database functions presented in Figure 2 and on criteria that comprehend the reading of the abstract or full content of the publication. Publications published in a year before 2000 (inclusive), in a non-peer-reviewed scientific journal, conference proceedings, or other source (for example, news, report, or electronic resource), or not written in English or Portuguese are excluded.

Publications not accessible or those that are only meta-data are excluded. Publications with BC considerations unrelated to the research question or with no results that support, streamline, or guide BCP implementation are also excluded.

Other exclusion criteria are based on results not transposable to organisations with ICT-based processes:

• Publication for a specific industry;
• Publication for a specific disaster or incident;
• Publication for a specific system;
• Publication for specific software.

Publications from before 2015 are excluded. Finally, publications can be included if they present relevant results that streamline, support, or guide the BCP implementation. Duplicate publications must be excluded to avoid bias in the results.

4. Search Strategy and Data Extraction

Scopus was selected because it is a comprehensive and curated abstract and citation database, indexing thousands of publishers, including Elsevier, with metrics and analytical tools to support decisions in the SLR [34] and added topic prominence. ScienceDirect contains full-text articles from journals and books, primarily published by Elsevier, but including some hosted societies [35].

We selected EBSCOhost because it indexes peer-reviewed content and other high-quality articles. It also adds searchable subject terms to enhance the classification of the publication. Publications that do not offer author keywords like “business continuity plan” but address the subject will be classified with “business continuity planning” in the subject terms by EBSCOhost curators, selecting two to twelve headings that highlight the main point of the article being indexed. It also has width filtering options and the ability to export the entire results in the BibTex format into one downloadable zip file.

4.1. Search Strategy

Our research used the Scopus, ScienceDirect, and EBSCOhost databases. We prepared Figure 2 to present the flow of filtering used to collect the publications used in this study. Scopus allows the full filtering flow presented to be included in the search string. Using these filters in a search string, ScienceDirect only allows filtering of document type and publication year, and EBSCOhost only allows publication year.

The search used a Boolean string, with only the AND and OR operators, on the searchable fields title (of publication), keywords, and abstract. If no abstract is available, EBSCOhost uses the first 1500 characters of the full text [36]. The PICOC keys and synonyms were included in the string. The words’ conjugations were included if they were a single word or the last word of a phrase. Scopus and EBSCOhost allow the wildcard “*” to streamline the string, ScienceDirect states that its search engine can find all forms of the same word (e.g., “plan” and “planning” using only “plan”), although it only allows eight operators.

Table 2. Specific database strings used.

Database	Full String
EBSCOhost	(“business continuity plan *” OR “disaster recovery plan *”) AND (guidelin * OR strateg * OR guidance *) AND (framework * OR approach * OR methodology * OR procedur * OR program *) AND (streamlin * OR bolster * OR encourage * OR expedit * OR optimiz * OR “speed up” OR support * OR improv * OR boost * OR assist * OR increase * OR agil *)
Scopus	(“business continuity plan *” OR “disaster recovery plan *”) AND (guideline * OR strateg * OR guidance *) AND (framework * OR approach * OR methodolog * OR procedur * OR program *) AND (streamlin * OR bolster * OR encourag * OR expedit * OR optimiz * OR “speed up” OR support * OR improv * OR boost * OR assist * OR increas * OR agil *)
ScienceDirect	(“business continuity plan” OR “disaster recovery plan”) AND (guideline OR strategy OR strategical OR guidance) AND (framework OR approach OR methodology OR methodological OR procedure OR program) AND (streamline OR bolster OR encourage OR expedite OR optimize OR “speed up” OR support OR improve OR boost OR assist OR increase OR agile)

* Any combination of characters.

presents the full string used on each research database.

The keywords in the phrases presented in Table 2 were separated into seven combinations for the Scopus and EBSCOhost databases, including the intervention keywords. ScienceDirect required 13 combinations due to a restriction in the number of operators. Therefore, combinations with comparison and outcome in the same string were not achievable.

4.2. Quality Assessment

Quality relates to the extent to which the study minimises bias, maximises internal and external validity, and provides more detailed inclusion/exclusion criteria [31]. The assessment of study design to guarantee a minimum level of quality explained in [31] has six questions related to the objectives, methodology, literature background, and results [2].

The quality appraisal of each primary study allows for grouping studies by quality before synthesising the results [31]. The results are assessed by assigning quality scores, and a study is omitted if it scores less than 2.5 points [2]. A study earns one point if it fully addresses the question, half a point for a partial response, and no points if it does not address the question at all.

4.3. Data Extraction

The data extraction form was designed to reduce the opportunity for bias and accurately record the information obtained from the primary studies [31]. The data extraction form questions were tested on a sample of primary studies and applied to the 393 quality-assessed publications. They were formulated to question, for example, whether the publication set strategic guidelines for implementing a BCP or was supported by or defined a framework [2].

This step was accomplished using the Parsifal software. This online tool allowed us to consistently assess every publication, share information with the research team, and prepare a summary of the results.

5. Research Results

The first iteration of the SLR considers 1297 non-duplicated publications from the years between 2000 and 2021, and considering all the other criteria presented in Section 4.1. For presentation and comparison purposes, the year 2021 is excluded, giving a total of 1284 publications. A full map of the topics covered by the SLR is presented in [2]. Further information about the BCM components has been published in [1].

The following subsection’s objective is to present the results and document the decision for excluding publications from the SLR.

Thus, as presented in Section 2.2, the basis for this research lies in pinpointing gaps in the established definitions of metrics within the ISFs, aiming to streamline the implementation of a BCP. The ITIL 4, COBIT 2019, CMMI V2.0, ISO 22301:2019, and NFPA 1600 references have all been updated since 2018. Therefore, new considerations, technologies, or methodologies should be now included in the publications since 2018.

However, in the publications’ analysis resulting from the SLR, mentioning the ISF in the publications is scarce when communicating strategic guidelines for continuity planning.

5.1. Publications by Year

Using the search string presented in Section 4.1, the results are distributed according to the elaborated Figure 3, having something related to BCP or disaster recovery plans (DRPs).

The number of publications by year does not reveal the research subject areas. Nonetheless, the number of publications returned using the search string has been increasing since 2001, mainly due to terrorism and natural-disaster-related publications. From 2000 to 2010, the average was 42 publications, doubling in the years after 2010.

5.2. Publications by Journal Title

From the total of 1297 publications, we created Figure 4 to present a selection of the top nine journal titles with publications that can contribute to the research question. All other sources have no publications or one. Figure 4 presents the total amount of sorted data (since 2015).

Analysing the data in Figure 4, the Journal of Business Continuity & Emergency Planning has the highest number of publications between 2000 and 2015. The source with the second largest number of publications is the Journal of Disaster Research.

It should be noted that three of the nine sources presented in Figure 4 refer, in their title, to an area related to ICT, and three of the nine sources have a title that contains the word “disaster” or “continuity”.

There have been 268 publications since 2000 without journal titles, which are, therefore, not included. Nevertheless, they represent mainly EBSCOhost results for books, ebooks, PhD theses, and other miscellaneous sources.

5.3. Publications by Keyword

For all the 1297 publications returned, we devised Figure 5, which reveals the keywords used by the authors combined with non-duplicated keywords introduced by the research databases. There are 7558 keyword occurrences, with 3575 distinct keywords.

Despite the differences, summing “business continuity planning”, “business continuity plan”, and “disaster recovery plan” represents 34% of all the 1297 publications. Risk management or risk assessment are keywords used in 14% of the publications. Considering the broader term of organisational resilience as the ability of an organisation to absorb and adapt to a changing environment [37], other related areas are also represented. The results show that emergency management is referred to within 10% of the set. Crisis management is an area addressed in 6% of the publications.

5.4. Publications That Provide Guidelines and Strategy Considerations

Figure 6 depicts the 143 final publications published since 2015, with the key search terms defined in PICOC. The “total” bar represents the total number of publications that have the term in the keywords, abstract, or title.

The terms “business continuity plan” or “disaster recovery plan” are referenced in 138 publications. Individually they are referred to in 60 abstracts, 33 titles, and 74 keywords. The five publications missing of the 143 total publications were manually added to the SLR.

The terms “guideline”, “guidance”, or “strategy” are referenced in 67 publications. Individually they are referred to in 60 abstracts, six titles and 11 keywords. The amount rises to 72 publications when considering “streamline” and all its synonyms in the search terms. Individually they are referred to in 69 abstracts, nine titles, and four keywords.

Under the term “framework” and its synonyms, they are identified in 96 publications. Individually they are referred to in 95 abstracts, 28 titles, and 13 keywords.

It should be noted that five of the six standards (ITIL, COBIT, CMMI, ISO 22301, and NFPA 1600) studied in this work have been updated since 2018 and, thus, potentially are considered in the 63 publications resulting from the SLR.

All publications use “business continuity plan” or “disaster recovery plan”, and it is relevant to highlight that 20% of all publications suggest a framework, considering the title. Almost half of the publications, in their abstract, refer to the terms “guideline” or “streamline”, possibly suggesting that business continuity planning is an area that needs intervention to reduce development or implementation constraints.

5.5. Publications by Extraction Data Question

Considering the results obtained in the data extraction phase of the SLR process, Figure 7 depicts the 143 publications published since 2015 (inclusive) and quantifies them concerning the contribution to the research, according to the question defined in the data extraction.

About 15% of the publications establish a process of measuring the BCP implementation; however, the majority address specific components of a BCP or BCM. It should be noted that about two-thirds of the publications consider organisations with ICT-supported business processes. Similarly, some publications suggest ways to support and streamline BCP implementation in an organisation.

6. Discussion, a Perspective, and an Outlook for Future Research

Organisations benefit from a framework that directs the mitigation efforts for business disruptions, especially during the BCP design phase. It is acknowledged that there are gaps in assessing the capacity or maturity of achieving these activities; such assessments help to gauge the level of accomplishment compared to the desired functionality for each BC activity.

The SLR presented here was developed with the invaluable help of powerful research databases, with adequate functions and options to search and export the results. The Parsifal software is decisive in registering the protocol and developing and carrying out the quality assessment and data extraction processes. This paper aimed to return studies that provide strategic guidelines for implementing a BCP, considering the initiation constraints and the gaps identified in the ISFs. Therefore, these ISFs are relevant for the SLR studies analysis.

According to all the 1297 publications, 949 studies use the PICOC keywords (BCP or DRP) in the abstract, and 429 studies use them in the subject terms, topic prominence, or author keywords. Considering the combination with the other intervention keywords (guidelines and strategy), the number decreases to 26 studies which mention these in the abstract. No studies use these keywords in author keywords, subject terms, or topic prominence. Furthermore, by combining the intervention (BCP, DRP, strategy, and guidelines) with all ISFs mentioned in this paper, the number of studies is four, with only one since 2018.

We will introduce some areas of research that could be future research paths, either because of a lack of studies or by being innovative or prominent themes. Nevertheless, it is relevant to give a perspective of the results and point to the path forward. We have selected some identified components of the BCM as a perspective of the results.

6.1. Business Continuity

Concerning BC, an overview of the various concepts of BC is presented in

Table 3. Research objects in the BC area.

Research Object	Main Studies
BC Culture	[38]
Strategy	[3,39,40,41]
BC Management	[17,42,43,44]
Crisis communication and Disaster Planning	[45,46,47,48,49,50]
Risk Management and Business Impact Analysis (BIA)	[51]
Contingency Planning	[27]
ICT Governance in BCM	[52]
Information Systems Continuity	[53]
BCP	[13,54,55,56,57]
Supply Chain Management	[55]
Continuous Support to Customer	[58]
Change Management	[59]

, considering the focus or object that characterises the concept. This analysis aims to provide the various perspectives by which the literature defines BC. Thus, “business continuity” is associated with several research objects.

Because of the variety of research objects exemplified in Table 3, the definition of BC is not unique. BC is a relatively modern management discipline derived from disaster recovery in the 1980s, which began in the mid-1970s [60]. Regarding the perspective of resilience and the organisation’s capacity to deal with a disaster, some authors refer to this capacity in their definition.

The studies in Table 3 present concepts of resilience, disaster, incident, crisis, and emergency as differentiators of the organisation’s response in terms of installed capacity, necessary preparation and readiness, and inherent risk. These differences highlight the need for different strategies for different planning and affect the organisation’s BC differently.

6.2. Business Continuity Management

Implementing an effective BCMS is challenging, demanding, time consuming, and holistic [61]. Consequently, there is a pressing need to streamline the organisational process of implementing a BCP and offer support in this endeavour. Given that SMEs often possess limited resources and expertise for BCMS implementation [15], it becomes essential to devise strategic guidelines for BCP implementation that can flexibly adapt to an organisation’s maturity and capacities.

Regarding motivation, the SLR has furnished the theoretical foundation [31] to underpin the development of a solution to the problem and its associated requirements. Through the SLR, it has been feasible to identify the various components and activities related to BCM from publications spanning the years 2000 to 2021, with a particular emphasis on those published from 2015 onwards. Consequently, it holds significance to identify the BCM components and the associated prerequisites in order to address the identified gaps and alleviate the constraints outlined in Section 1. When designing the BCP, it is crucial to take into account the recommendations offered by the strategic guidelines suggested by the publications resulting from the SLR. All the knowledge accumulated should be synthesised and integrated into a comprehensive set of guidelines aimed at simplifying the organisational processes involved in BCP development.

Table 4. Quantitative synthesis of publications by BCM component.

BCM Component	Number of Publications
Administration Support	29
BC Teams	19
Understanding the Organisation	31
Risk Assessment	167
Business Impact Analysis	58
BCM Strategy	121
ICT Strategy	129
Alternatives to Critical Functions	26
BCP Design and Implementation	163
BC Training	20
BCP Testing, Maintenance, and Analysis	68

presents a summary of the number of publications grouped by components of the BCM that were used as a basis for understanding the main concerns and areas of interest in the BCM research area.

The data presented in Table 4 underscores the limited volume of publications that address the research objects of support and commitment of top management (administration support), understanding of the organisation, or BC training. It is imperative to take all thematic areas into account when formulating a BCP.

However, the analysis presented in Table 4 revealed more publications addressing the risk assessment, business impact analysis, strategy for the BCM, or the ICT strategy. The BCP and DRP are mentioned in each SLR publication, considering that they are part of the research phrase.

Despite the crucial role of BCP design, it is worth noting that there are no publications specifically focusing on BC teams as a research objective. However, 19 publications do mention this subject within the context of the BCM program.

6.3. BCM Components

The SLR results highlighted some thematic groups in the research, communicated by organisations or studies in the health, oil, banking, or financial organisations activity sectors.

Figure 8 depicts these thematic groups.

Figure 8 (he arrows represent the dependence of the groups) includes thematic research groups in a structural representation of BCM components, as outlined in Table 4. The shapes added to the BCM components in Figure 8 indicate a trend driven by the presence of more publications on these subjects.

Within Figure 8, two significant research areas have been introduced: emergency response and crisis management. Additionally, Figure 8 incorporates the “mass trauma” domain, which encompasses considerations regarding how pandemics or infectious disease outbreaks can impact business processes and the preparations needed to address the resulting events. These considerations should be integrated into the BCP design, including the readiness of teleworking resources supported by ICT.

The broader area of research concerning “natural disasters” is also represented in Figure 8, recognising that natural disasters constitute the most prevalent sources of business process disruptions and sometimes even infrastructure damage. Consequently, the BCP must encompass strategies for dealing with the repercussions of events triggered by natural disasters. It should document alternative arrangements for BC, particularly in regions frequently affected by natural disasters or for teleworking initiatives.

Technical failures, like hardware or software malfunctions, and human threats such as terrorism, are also noted as factors leading to business disruptions in publications, prompting the need for adequate and timely planning. Thus, the strategic guidelines for BCP design must take into account the support and recommendations provided in publications covering these areas.

Among the publications, 42 discuss aspects of BCM program management, while 11 delve into the management of BCM components as projects. For example, out of the 29 publications related to the “administration support” component, 17 address program or project management commitments. “Understanding the organisation” is another relevant perspective, with 17 publications focusing on raising awareness about BC. Concerning organisational culture within BCM programs or projects, 14 publications acknowledge its significant impact on all stages of BCP design and implementation, along with activities related to the plan–do–check–act (PDCA) cycle referenced in the ISFs.

Risk assessment (RA) is a critical step in BCP design, as evidenced by 39 publications dedicated to this topic out of the 167 addressing risk-related issues. Among these, 20 publications offer strategic guidelines for RA. Information security issues feature prominently in 25 publications, with 12 specifically focusing on cybersecurity and cyberattacks. Furthermore, 10 publications delve into data centres and cloud computing, discussing their strategic design and implementation to enhance BCP.

Financial loss risk is a focal point in 10 publications, often serving as a justification for BC investments. Supply chain continuity risk is another concern, highlighted in 12 publications, touching on relationships with service or product providers and outsourcing in 8 publications.

BIA, a crucial aspect of BCP, is the subject of 58 publications. Among them, 15 publications present frameworks or methodologies for addressing BIA, sometimes integrated with risk assessment and BCP. Eight publications relate BIA to information systems and ICT. Five publications address information- and data-related concerns, while six are dedicated to recovery objectives. Moreover, 11 publications explore strategies for analysing the impact of natural disasters.

The ICT strategy, a component of the BCM strategy, garners 129 publications in total, with 33 offering clear ICT strategy guidelines. Within this category, 23 publications focus on information security, and 11 provide specific strategic planning guidelines for addressing cybersecurity incidents.

Within the “ICT strategy” guidelines, there is a substantial focus on improving data centre provisions, as indicated by 30 publications. Out of this subset, 11 publications centre on cloud computing, and three delve into virtualisation issues. Backups and their restoration are discussed in seven publications, with five addressing network-related concerns. Specific guidelines for information systems are presented in three publications, while change management, specifically in the context of change requests for the ICT infrastructure, is explored in five publications.

7. Conclusions

Within the BCP, which serves as a key artefact in BCM, solutions and circumstances are planned to expedite the process of returning the business to its standard operational state. In this regard, organisations seek support for the design and/or implementation of a BCP and/or for the BCM, which conveys the guarantee that they are capable, or that they are prepared, to respond effectively and efficiently to a business interruption. This work established that the amount of publications related to BC planning is significant, and that the publications are mainly obtained from natural disaster communication. It has further solidified the assertion that the constraints and limitations associated with BC will invariably impact organisations, encompassing their personnel, processes, and technology. One path of research is to carry out a study that quantifies and/or qualifies the constraints felt by the different dimensions of an organisation and sectors of activity.

As identified, a significant number of authors tend to report their experience in applying business continuity and disaster recovery solutions and report good practices in their implementation. Thus, considering that the ISFs have been updated since 2018, there is space to report success stories with the application of the new ISFs and to report the main practical or methodological changes that have produced or are expected to produce different results.

The results show that cybersecurity fits especially within the scope of disaster recovery. However, some studies indicate that awareness and organisational culture can prevent the exploitation of vulnerabilities and reduce threats. In this way, comprehensive business continuity management gains value by including IT security issues in the BCM processes. Thus, it is considered relevant to understand whether the efficiency and effectiveness of information security integration in the BCMS are enhanced by a targeted approach or taken out of the context of a BCMS. In particular, it is relevant to understand whether the training, tests, and exercises planned by the DR could have increased their value, efficiency, or effectiveness if they were included and managed by the BCMS.

Analysing the results of this work, it is observed that the number of studies on the importance of setting up teams is minimal. Despite the importance of designing a BCP, there are no publications with BC teams as a research objective, although there are 19 publications that mention the topic in the BCM program. A potential future research path is to evaluate the impact of the creation and maintenance of BC teams with the due formalities described in the ISFs. The research could question whether the BC teams allow the streamlining of organisational processes that culminate in the design and implementation of a BCP and the capacity or quality of the organisation’s response to an incident or disaster.

The SLR has yielded a limited number of publications addressing the aspects of what should be measured and the key metrics associated with each component or activity within BCM. Measurement is essential for gauging the level of accomplishment relative to desired outcomes for a given BCM activity. Developing metrics and analysing their outcomes can highlight areas requiring action to enhance BC preparedness and response readiness for business interruptions or incidents. While project success is measured upon completion, performance measurement is an ongoing process throughout the project’s lifecycle [62].

In terms of publications dealing with the subject of what should be measured, there is a noticeable gap in understanding which metrics are suitable for evaluating the capacity or maturity of BCM activities. Nevertheless, numerous publications strive to enhance the comprehension of BCM components or activity outcomes. However, the number of publications explicitly detailing metrics remains limited, with most of them primarily focused on justifying investments in the BCM program, conducting risk assessments, or delineating metrics related to specific ICT systems.

The final result of our research will contribute to the understanding of the importance of measuring the implementation of the BCP and how to strategically guide stakeholders on what needs to be achieved within the scope of the BCM to comply with good practice in the literature and standards.

In future work, it is recommended to evaluate the impact of adopting the proposed artefact in pilot organisations and report the results to the scientific and professional community.