BSI 200-4: contingency plans that hold

BSI Standard 200-4 replaced Standard 100-4 and describes how to build business continuity management within IT-Grundschutz. It is staged: from a reactive BCMS through a development BCMS to a standard BCMS. Which stage suits you depends on your protection needs – the technical requirements grow accordingly.

Standard 200-4 is more practice-oriented. New above all is the stage model, which allows a step-by-step build-up, as well as an extensive set of aids and templates. Anyone who worked to 100-4 can build on it, but must transfer the documentation.

An IT contingency plan names the critical processes, the permissible downtime and data loss, the responsibilities and reporting channels, the steps for recovery, and the details of service providers and how to reach them. It must be exercised regularly and updated after every drill. centron supplies the details on the operator, locations and backup procedures.

The recovery time objective is the time that may pass until a service is restored. The recovery point objective is the period whose data may be lost in an emergency. You define both values in the business impact analysis, not the service provider. From them follow the backup interval and the redundancy that are technically required.

No. The protection needs assessment, business impact analysis and the plan itself remain with your authority – they depend on your systems and your responsibility. centron provides the infrastructure on which the planned recovery times are achievable, plus the evidence: certificates with scope, documentation of technical measures and the data processing agreement in the Trust Center.

Geo-redundancy means data centres are operated with enough physical separation that a single event such as flooding, fire or a wide-area power outage does not hit several at once. The BSI’s criteria for selecting sites for highest-availability and geo-redundant data centres are decisive. centron has operated geo-redundancy since 2016 across several locations in Germany; Hallstadt, Nuremberg and Frankfurt am Main lie within the scope of the ISO 27001 certification. Whether your project needs geo-redundancy follows from your protection needs assessment.

In a ransomware attack, the backups are targeted first – encrypted or deleted so that recovery becomes impossible. Immutable backups cannot be overwritten or deleted within the defined retention period, not even with administrative rights. This is implemented via the object lock function of S3 Object Storage. Recovery remains possible without giving in to the demand.

BSI standard 200-4 envisages regular tests and drills but sets no fixed rhythm for all institutions; protection needs and criticality are decisive. Independently of that, Art. 32(1)(d) GDPR requires a procedure for regularly reviewing effectiveness. In practice, at least one documented restoration per year per critical procedure has proven itself.

Yes. Test restores and recovery exercises can be planned and supported – with named contacts instead of a ticket system. That is the difference between a plan on paper and one whose recovery time you can evidence.

The certificates with their stated scope, the BSI C5 attestation, the documentation of technical and organisational measures under Art. 32 GDPR and the data processing agreement. Plus the operating details that belong in your recovery plans: locations, backup procedures, reporting channels and availability. Everything is in the Trust Center.