On 16 April 2024 the UAE recorded its heaviest rainfall since records began in 1949, with 254 mm falling in under 24 hours in Al Ain. Roads flooded, flights were disrupted and remote working was mandated. For many businesses, the most useful question that week was a simple one: do we know what to do when we cannot operate normally?

A business continuity management system (BCMS) is how an organisation answers that question in advance.

A BCMS is a system, not a document

A business continuity plan is a document. A BCMS is the management system around it: the roles, analysis, procedures, testing and review that keep the plan accurate and usable. The difference matters. A plan written once and filed away is usually out of date within a year, as people, suppliers and systems change.

A working BCMS answers five questions:

  1. What must keep running? Your critical activities and products.
  2. How long can each one stop? Your tolerance for downtime.
  3. What do they depend on? People, sites, systems, suppliers and information.
  4. What will we do if a dependency fails? Workarounds and recovery steps.
  5. How do we know it works? Exercises, reviews and lessons learned.

The building blocks

  • Business impact analysis (BIA). Identifies critical activities and the impact of disrupting them over time. It produces your recovery time objectives (RTO): how quickly each activity must be restored.
  • Risk assessment. Looks at the threats that could cause disruption, from cyberattacks and supplier failure to fire, flooding and the loss of key people.
  • Continuity strategies. The options you choose: alternate sites, remote working, cross-trained staff, second suppliers, offline backups, manual workarounds.
  • Plans and procedures. Who declares an incident, who leads, what is restored first, how you communicate with staff, customers and authorities.
  • Exercises. Walkthroughs and simulations that test whether the plan works in practice.
  • Review and improvement. Updating the system after exercises, incidents and business changes.

NCEMA 7000 and ISO 22301

In the UAE, the national standard is AE/SCNS/NCEMA 7000:2021, the National Standard for Business Continuity Management System issued by the National Emergency Crisis and Disasters Management Authority. Its structure closely follows the international standard ISO 22301.

Many government entities and critical-sector organisations are required to align with NCEMA 7000; in Abu Dhabi, for example, the emergencies and crisis management centre has reported dozens of government entities and companies meeting its compliance requirements. For private SMEs, the standards are best used as a proven structure to follow, whether or not you pursue formal certification through an accredited body.

Why SMEs are more exposed, not less

Large organisations have redundancy built in: more people, more sites, bigger IT teams. Smaller organisations tend to depend on a handful of people, one office, one key supplier and one core system. That concentration is exactly what a BCMS is designed to find.

The 2014 case of Code Spaces shows the extreme. An attacker took control of the company’s cloud account and deleted its data along with the backups stored in the same account. The business shut down within about twelve hours. Separate, tested backups and a recovery runbook would have changed that outcome.

A practical path for an SME

  1. Start with a one-page BIA. List your ten most important activities, how long each can stop, and what each depends on.
  2. Find the single points of failure. One person, one supplier, one system, one site.
  3. Fix the cheapest gaps first. Document critical procedures, cross-train a second person, separate and test backups, keep an offline contact list.
  4. Write a short incident plan. Who decides, who acts, who must be told, and in what order things are restored.
  5. Run a 90-minute tabletop exercise. Walk through a realistic scenario and note what breaks.
  6. Review twice a year. Update after any significant change to people, suppliers or systems.

Where Recall fits

Recall helps organisations build these fundamentals in a practical way, aligned with ISO 22301 and NCEMA 7000 structures. We map critical processes and dependencies, document SOPs and escalation, set up incident procedures and run scenario reviews with your team. For specialist areas such as cyber readiness, we work with qualified partners.

Want a quick view of your exposure? Try the business resilience simulator, or talk to us about a resilience review.