Emergency Response

Emergency management under BSI Standard 200–4 encompasses the systematic planning, implementation and review of measures to handle emergencies and crises. Published in 2023, BSI 200–4 replaced the predecessor BSI 100–4 and introduces three maturity levels: Reactive BCM (4–8 weeks), Build-up BCM (3–6 months) and Standard BCM (6–12 months). Core elements include Business Impact Analysis (BIA), emergency planning, the emergency handbook and regular emergency exercises.

Three key frameworks govern emergency management in Germany: BSI Standard 200–4 as the national guideline for business continuity management, ISO

22301 as the international standard for BCMS certification, and MaRisk AT 7.3 with specific emergency concept requirements for banks and financial services. Since December 2025, NIS-2 (Section

30 BSIG) also explicitly requires measures for maintaining operations including crisis management.

An emergency concept according to BSI 200–4 must include: Business Impact Analysis (BIA) with defined RTO and RPO values, risk analysis of identified critical processes, a preventive emergency preparedness concept, an emergency handbook with immediate measures and escalation paths, alerting and communication plans, recovery and restoration plans, and an exercise concept with regular tests.

Emergency management and crisis management differ in timeframe, escalation level and responsibility. Emergency management responds to specific disruptions or failures (e.g. IT system outage, site failure) and is led by the emergency team with a technical focus — typically hours to a few days. Crisis management is activated when an emergency threatens the organisation overall capability to act and lies with senior management with strategic decision authority. BSI Standard 200–4 defines clear handover points between both disciplines.

MaRisk AT 7.3 requires banks and financial institutions to maintain an emergency concept based on an impact analysis. Requirements include: contingency provisions for emergency operations, restart plans for time-critical activities and processes, communication rules for internal and external stakeholders, and regular emergency tests with reporting to senior management. The effectiveness and appropriateness of the emergency concept must be demonstrated through testing. MaRisk 7.0 (2025) further strengthens IT emergency management requirements in the context of DORA.

The Business Impact Analysis is the core of emergency management under BSI 200‑4. It follows four steps: First, identification of all business processes and their dependencies. Second, assessment of impacts in case of failure (financial, legal, reputational). Third, determination of recovery times — specifically MTPD (Maximum Tolerable Period of Disruption), RTO (Recovery Time Objective) and RPO (Recovery Point Objective). Fourth, prioritisation of critical processes as the basis for emergency plans and resource planning.

ADVISORI guides you through building BSI 200–4 compliant emergency management: from initial assessment and gap analysis through Business Impact Analysis and risk analysis to creating the emergency handbook and conducting emergency exercises. Our consultants have experience with financial institutions (MaRisk, BAIT, DORA), critical infrastructure operators and NIS-2 regulated organisations. We integrate emergency management into your existing ISMS and ensure compliance with all regulatory requirements.