.png)
.png)
A small BCM team should use its first 90 days to establish control, choose three to five priorities, advance the most consequential planning work, exercise one recovery path, and assign unresolved work an owner and date.
The goal is a controlled first cycle, not a finished program.
Here, a small team means one to three central BCM practitioners coordinating distributed owners and contributors.
90-day roadmap summary
- Days 1-30: Establish scope, inventory the program, and select three to five priorities.
- Days 31-60: Advance priority plans to an approved, revision, or documented deferral state and prepare one focused exercise.
- Days 61-90: Run the exercise, control the findings, report decisions, and schedule the next cycle.
- Choose the right starting path: A new owner needs a reliable baseline. A neglected program needs version reconciliation and triage.
- Keep the claim bounded: The roadmap creates control and evidence of progress. It does not prove that the full program will recover as intended.
This roadmap is practitioner guidance, not a certification method or a standard requirement. ISO 22301:2019 covers the management-system lifecycle but does not prescribe a 90-day schedule. Adapt the sequence to the organization's obligations, risk, authority, and resources.
Choose the right starting path
The same calendar can serve two different starting conditions, but the first questions are not the same.
| Decision point | Path A: Newly assigned owner | Path B: Neglected program |
|---|---|---|
| First question | What continuity work already exists, and who can confirm it? | Which records can still be trusted, and where has control been lost? |
| Main risk | Rebuilding work that already exists or accepting undocumented assumptions | Treating stale, duplicate, or unapproved records as current |
| First priority | Establish scope, relationships, ownership, and a reliable baseline | Reconcile versions, overdue decisions, open findings, and high-priority gaps |
| Useful early result | A program inventory and agreed priority list | A controlled queue showing what is current, under review, deferred, or superseded |
| What not to do | Launch an enterprise-wide rewrite before understanding the program | Close easy tasks while the most consequential gaps remain unresolved |
Path A: A newly assigned owner building control
A new owner should not assume the program is a blank slate. Find the existing policies, BIAs, plans, recovery procedures, exercise records, and approval evidence. Confirm scope and authority with the executive sponsor, then identify the owners, contributors, and approvers needed for the first cycle. The central BCM team coordinates the work. It should not own every recovery decision or operating procedure.
If crisis-team design or authority is unclear, treat it as separate strategic work. See MHA Consulting's guidance on how to set up a crisis management team.
Path B: A small team rebuilding a neglected program
A neglected program usually has documents but lacks reliable control over versions, approvals, assumptions, and unresolved findings. Separate records into practical states:
- current and approved;
- awaiting approval or under correction;
- deferred because a decision or dependency is unresolved;
- superseded or duplicate; and
- unknown because ownership or evidence cannot be confirmed.
Do not label an item current merely because it is the newest file. Require an identifiable version, owner, review status, and approval record.
The 90-day roadmap at a glance
| Phase | Objective | Primary ownership | Required outputs and evidence | Exit criterion |
|---|---|---|---|---|
| Days 1-30 | Establish control and select priorities | BCM program owner coordinates; executive sponsor confirms scope and priority | Program inventory, ownership map, three to five selected initiatives, decision log, deferred-work register, and day-30 baseline brief | The sponsor accepts the scope and priority order; every selected initiative has an owner, next action, date, and expected evidence |
| Days 31-60 | Move priority planning work to a defined state | Business-unit plan owners own accuracy; contributors validate their areas; BCM coordinates; designated approvers make or route decisions | Current plan drafts, review records, recorded dispositions, open-decision log, and a defined exercise objective and scope | Every priority plan is approved, returned for revision, or deferred with an owner, reason, and date; the focused exercise is ready |
| Days 61-90 | Exercise one recovery path and establish the next operating cycle | Exercise owner coordinates; plan owners accept findings; approvers and sponsor resolve or assign open decisions | Exercise record, corrective actions, plan changes, approvals or documented deferrals, day-90 decision report, and next governance dates | Every selected initiative has a visible outcome; every material open item has an owner and date; the next operating cycle is scheduled |
Follow the organization's authority model for approvals, risk acceptance, resource decisions, and corrective-action closure.
Days 1-30: Establish control and select priorities
The first month should produce one working view of the program. Inventory:
- applicable policies, requirements, and contractual commitments;
- BIAs, continuity plans, recovery plans, their owners, versions, and status;
- known critical operations and their supporting dependencies;
- exercises, incidents, findings, and corrective actions; and
- deadlines, audits, reporting commitments, and major organizational changes.
This inventory is not a maturity score unless the team applies a defined assessment method. It is a control record that shows what exists, what can be trusted, and what needs a decision.
For technology-related contingency planning, NIST SP 800-34 Rev. 1 provides a lifecycle reference for federal information systems. Other organizations may use it as informative guidance, not a universal BCM requirement.
Limit the first cycle to three to five initiatives
Michael Herrera has advised BCM managers to identify three to five initiatives that offer the greatest improvement in compliance or reduction in risk. For this 90-day cycle, select work the team can reasonably advance to a defined outcome.
Score each candidate initiative using five questions:
- Operational importance: Does it affect an operation whose recovery is poorly understood?
- Requirement pressure: Is there a dated regulatory, contractual, audit, policy, or customer obligation?
- Change or exposure: Has an incident, finding, ownership gap, material change, or conflicting version increased uncertainty?
- Decision value: Will the work resolve a decision, produce an approved record, or expose a material limitation?
- Feasibility: Can the team secure the owner, contributors, approver, and evidence within 90 days?
High importance with no available decision maker requires escalation, not false commitment. Easy tasks should not displace more consequential work merely because they improve the completion count.
Record everything not selected in a deferred-work register with the reason, accountable owner, required decision or input, consequence of delay, and next review date.
Produce a day-30 baseline brief
The day-30 brief should be short enough for leadership to use. Include:
- scope, sponsor, and confidence in existing records;
- the selected initiatives and reasons for choosing them;
- owners, approvers, target dates, and expected evidence;
- urgent decisions or resources; and
- deliberately deferred work.
Days 31-60: Move priority planning work to a defined state
The second month converts the baseline into controlled planning work.
| Work area | Newly assigned owner | Neglected program | Evidence by day 60 |
|---|---|---|---|
| Records and BIA inputs | Confirm existing inputs before creating new ones | Reconcile duplicates and confirm whether recovery objectives and dependencies remain usable | Owner, source, version, limitations, and required rework |
| Plans | Select a usable structure and draft priority plans | Correct high-priority plans and route them for review | Current draft, reviewer input, open decisions, and disposition |
| Ownership | Confirm owners, contributors, and approvers | Reassign orphaned work and escalate unavailable owners | Named roles and accepted handoffs |
| Exercise preparation | Select one important recovery path or decision to examine | Use a known gap or changed assumption to set the objective | Objective, scope, participants, and planned evidence |
Use the business continuity plan guide for detailed plan structure and maintenance guidance.
Define the required disposition before work begins
For each selected plan, distinguish among:
- Draft prepared: Required sections exist, but review or decisions remain open.
- Review completed: Defined reviewers examined the plan and recorded a disposition.
- Plan approved: An authorized approver accepted an identifiable version.
- Deferred with accountable action: A dependency blocks progress, and the issue has an owner and date.
A document is not approved because comments stopped arriving. A review is not complete because a meeting occurred. Before work begins, define whether the required outcome is an approved version, a revision decision, or a documented deferral.
When plan work becomes difficult to control manually
A small pilot can run with a controlled spreadsheet, shared documents, and disciplined file naming. That approach becomes difficult when the team spends more time reconciling files, owners, comments, versions, BIA inputs, and exercise records than advancing the work.
BCM Planner is a great tool that can help. Its public product page documents plan-template creation and upload, plan creation and editing, BIA data integration, centralized plan storage and sharing, and exercise-result recording.
The software does not decide which operation matters most, whether a recovery strategy is adequate, or who has approval authority. Those remain organizational decisions.
When evaluating the current process, ask:
- Can we identify the working and approved version of every priority plan?
- Can owners see what needs attention?
- Can we keep BIA inputs, plan content, versions, and exercise results connected?
- Can we report status without merging several spreadsheets and email threads?
If several answers are no, the team has a workflow problem in addition to a capacity problem.
Days 61-90: Exercise one recovery path and establish the next operating cycle
The final month should examine a meaningful part of the work. Choose one priority operation, recovery procedure, escalation decision, dependency, or manual workaround where the result will influence a real plan or decision.
Run a focused exercise and control the findings
Document:
- the exercise objective and scope;
- the plan version and assumptions examined;
- participants and their roles;
- decisions, observations, and limitations;
- corrective actions, owners, and dates; and
- any plan changes or approvals required.
A tabletop can reveal gaps in assumptions, roles, and decisions. It does not prove that technology will recover within target or that every procedure will work during a disruption. State what the exercise examined and what it did not prove.
Route plan-specific findings into the relevant plan. Put strategy redesign, major technology testing, crisis-governance changes, and funding decisions into separate accountable work.
Give leadership a day-90 decision report
The day-90 report should answer:
- What scope did the team bring under control?
- What is the disposition of each selected initiative?
- What did the exercise examine, and what did it not prove?
- Which material limitations, decisions, and corrective actions remain, and who owns them?
- What should the next 90 days address, and what support is required?
Report activity and readiness evidence separately. Counts of plans, meetings, or exercises show work volume, not whether recovery strategies are feasible.
Use the BCM governance cadence to move the work from a temporary roadmap into recurring reviews, decision logs, open-item tracking, evidence upkeep, and management reporting.
The first 90 days should establish control. The next phase must keep BIAs, plans, exercises, measures, and decisions moving together. Use The 2026 BCM Playbook: From Plans to Measurable Progress to plan that transition.
What a successful first 90 days looks like
By day 90, the scope and sponsor should be clear, priority records should have identifiable owners and versions, selected plan work should have a documented disposition, and one meaningful recovery path or decision should have been exercised. Every material finding and unresolved decision should have an owner and date, leadership should have a concise decision report, and the next governance dates should be scheduled.
That is not a finished BCMS, certification, or proof of recovery. It is a controlled starting point a small team can sustain.
Download The 2026 BCM Playbook: From Plans to Measurable Progress to build the next operating cycle around current data, tested strategies, useful measures, and visible follow-through.
