BIA Questionnaires
Part 5: Inter-dependencies
Notes for BCM Institute's Course Participants: This is the template for completing the "Part 5: Inter-dependencies."
CBF 6: Information Systems & Records Management
In today’s complex business environment, no function operates in isolation. Every department, system, and stakeholder plays a role in supporting or being supported by others. In the context of Business Continuity Management (BCM), understanding these relationships is critical to identifying potential cascading impacts during a disruption.
Purpose of Chapter
This chapter, Part 5: Inter-dependencies, focuses on identifying and documenting the internal and external dependencies associated with each Critical Business Function (CBF).
By doing so, organisations can uncover vital linkages across business units, third-party service providers, and upstream and downstream processes that are essential for maintaining continuity and resilience.
This section provides guidance on categorising dependencies based on their source (internal or external), their direction (upstream, downstream, or mutual), and their nature (operational, regulatory, or technical). It also helps organisations to visualise the ripple effects that can occur during a disruption, enabling them to plan more effective mitigation strategies and recovery efforts.
Here is the table for Critical Business Function CBF-6: Information Systems & Records Management for Bandtree, which incorporates sub-processes (Sub-CBFs) and details their dependencies in line with BCMpedia's interdependency concepts.
Table 5: [BIA] [P5] Inter-dependencies for CBF 6: Information Systems & Records Management
|
|
|
Type of Dependency |
|
||
Sub-CBF |
Sub-CBF Code |
Name of Business Unit or Vendor/ Supplier/ Outsource Partner |
Internal |
External |
Direction |
Description of Nature of Dependency |
ICT Infrastructure Management |
6.1 |
IT Department |
✔️ |
X |
Up-stream |
Provides core infrastructure (networks, servers, hardware) that supports all digital operations. |
Property Systems Application Support |
6.2 |
IT Application Support Team / External App Vendor |
✔️ |
✔️ |
Mutual |
Ensures continuity of mission-critical property management systems. |
Records Retention & Archiving |
6.3 |
Records Management Unit |
✔️ |
X |
Down-stream |
Ensures archived records are accessible, organized, and compliant with regulations. |
Data Backup & Recovery |
6.4 |
IT Infrastructure & Security |
✔️ |
X |
Up-stream |
Provides system and data continuity during IT disruptions or disaster recovery. |
Cybersecurity & Access Control |
6.5 |
Cybersecurity Team / Security Vendors |
✔️ |
✔️ |
Mutual |
Protects information systems from breaches and ensures controlled access. |
System Development & Enhancement |
6.6 |
Internal Dev Team / Outsourced Developers |
✔️ |
✔️ |
Mutual |
Develops and improves systems based on operational needs and stakeholder feedback. |
ICT Vendor Management |
6.7 |
Procurement / Vendor Relations |
✔️ | ✔️ | Mutual |
Coordinates and governs service contracts, performance, and support levels. |
User Training & Support |
6.8 |
IT Helpdesk / Learning & Development |
✔️ | X | Down-stream |
Provides training and support to end-users for system use and digital literacy. |
Compliance & IT Governance |
6.9 |
Risk & Compliance Unit / Internal Audit |
✔️ | X | Down-stream |
Ensures IT activities align with legal, regulatory, and policy frameworks. |
Physical Records Handling |
6.10 |
Facilities / Admin Services / Records Vendor |
✔️ | ✔️ | Mutual |
Maintains and retrieves physical records critical to business operations and compliance. |
Summing Up ... Part 5
Interdependencies form the hidden network that holds business operations together.
When disruptions occur, these linkages can either amplify the impact or provide critical pathways for recovery, depending on how well they are understood and managed. By systematically mapping out dependencies, organisations strengthen their ability to respond to crises in a coordinated, informed manner.
This chapter has equipped readers with a framework to recognise, evaluate, and document dependencies at both strategic and operational levels. Ultimately, this clarity supports not only better recovery planning but also improves decision-making across the enterprise.

BIA Questionnaires
Part 6: Vital Records
Notes for BCM Institute's Course Participants: This is the template for completing the "Part 6: Vital Records."
CBF 6: Information Systems & Records Management
Vital records are critical to the continuity and recovery of business operations in the event of a disruption.
For Bandtree, the CBF-6: Information Systems & Records Management function supports all corporate and operational tasks by ensuring that essential digital and physical records are protected, accessible, and recoverable.
This includes managing infrastructure, software systems, data integrity, cybersecurity, compliance, and safeguarding sensitive documentation.
Given Bandtree's role in managing Brunei’s strategic corporate property assets, the availability, confidentiality, and integrity of ICT systems and records are vital to its operations.
This section identifies the vital records across the sub-processes within CBF-6, categorising them based on media type, storage location, and designated custodians to support a structured and resilient approach to records protection and recovery.
Purpose of Chapter
This chapter outlines the types of vital records associated with each sub-process within CBF-6, including their formats, storage locations, and custodianship.
Emphasis is placed on both physical and digital recordkeeping practices to ensure redundancy, traceability, and secure access.
Based on the sub-processes (Sub-CBF) of CBF-6: Information Systems & Records Management for Bandtree, and following the structure for documenting Vital Records as referenced from BCM Institute's guidance notes, this is the table:
Table 6: [BIA] [P6] Vital Records for CBF 6: Information Systems & Records Management
Sub-CBF |
Sub-CBF Code |
Description of Vital Records |
Media Type |
Location |
In Whose Care |
ICT Infrastructure Management |
6.1 |
Network diagrams, system configuration files, and equipment inventory |
Digital (cloud/local) |
On-premise server room; Cloud backup (e.g. AWS, Azure) |
ICT Manager |
Property Systems Application Support |
6.2 |
Application source code, licensing records, system access logs |
Digital |
Central IT Repository; Cloud repository |
Application Support Lead |
Records Retention & Archiving |
6.3 |
Document retention schedules, archived reports, and metadata indexes |
Physical & Digital |
Records Room; SharePoint Archive System |
Records Management Officer |
Data Backup & Recovery |
6.4 |
Backup schedules, restoration logs, encrypted backup copies |
Digital |
Offsite backup facility; Cloud storage (e.g. OneDrive/Cloud) |
IT Operations Lead |
Cybersecurity & Access Control |
6.5 |
Access control lists (ACLs), cybersecurity policies, and audit trails |
Digital |
Cybersecurity folder; Secure local drives |
Cybersecurity Officer |
System Development & Enhancement |
6.6 |
Development plans, change logs, and test reports |
Digital |
Development server; Project documentation portal |
System Analyst |
ICT Vendor Management |
6.7 |
Vendor contracts, service level agreements (SLAs), and contact list |
Physical & Digital |
Procurement Office; Vendor Management System |
Procurement Officer / ICT PM |
User Training & Support |
6.8 |
Training manuals, user feedback logs, support ticket history |
Digital |
Knowledge Base platform; Helpdesk System |
ICT Helpdesk Lead |
Compliance & IT Governance |
6.9 |
IT audit reports, compliance checklists, policy documents |
Physical & Digital |
Compliance folder (shared drive); Secure cabinet |
IT Compliance Officer |
Physical Records Handling |
6.10 |
Physical records, logs, movement forms, access authorisations |
Physical |
Records Room, HQ Level 4 |
Records Custodian |
Summing Up ... for Part 6
The classification and safeguarding of vital records under CBF-6 ensures that Bandtree’s digital and physical information assets remain protected and accessible during disruptions.
Proper identification of responsible custodians, storage locations, and record formats allows for efficient recovery of services and preserves the trust of stakeholders and clients.
By maintaining an up-to-date inventory of vital records and aligning with best practices in IT governance and compliance, Bandtree reinforces its operational resilience and commitment to national infrastructure stability.
As technology evolves, so too must our methods for securing the information lifelines that sustain our critical business functions.
More Information About Business Continuity Management Courses
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].