BCM BandTree

[BCM] [BT] [E3] [BIA] [T3] [CBF] [6] Information Systems & Records Management

Written by Dr Goh Moh Heng | Jun 18, 2025 2:38:48 PM
 

BIA Questionnaires 

Part 5: Inter-dependencies

Notes for BCM Institute's Course Participants: This is the template for completing the "Part 5: Inter-dependencies."

 

CBF 6: Information Systems & Records Management


In today’s complex business environment, no function operates in isolation. Every department, system, and stakeholder plays a role in supporting or being supported by others. In the context of Business Continuity Management (BCM), understanding these relationships is critical to identifying potential cascading impacts during a disruption.

Purpose of Chapter

This chapter, Part 5: Inter-dependencies, focuses on identifying and documenting the internal and external dependencies associated with each Critical Business Function (CBF).

By doing so, organisations can uncover vital linkages across business units, third-party service providers, and upstream and downstream processes that are essential for maintaining continuity and resilience.

This section provides guidance on categorising dependencies based on their source (internal or external), their direction (upstream, downstream, or mutual), and their nature (operational, regulatory, or technical). It also helps organisations to visualise the ripple effects that can occur during a disruption, enabling them to plan more effective mitigation strategies and recovery efforts.

Here is the table for Critical Business Function CBF-6: Information Systems & Records Management for Bandtree, which incorporates sub-processes (Sub-CBFs) and details their dependencies in line with BCMpedia's interdependency concepts.

Table 5: [BIA] [P5] Inter-dependencies for CBF 6: Information Systems & Records Management

 

 

 

 

Type of Dependency

 

Sub-CBF

Sub-CBF Code

Name of Business Unit or Vendor/ Supplier/ Outsource Partner

Internal

 External

Direction

Description of Nature of Dependency

ICT Infrastructure Management

6.1

IT Department

✔️

X

Up-stream

Provides core infrastructure (networks, servers, hardware) that supports all digital operations.

Property Systems Application Support

6.2

IT Application Support Team / External App Vendor

✔️

✔️

Mutual

Ensures continuity of mission-critical property management systems.

Records Retention & Archiving

6.3

Records Management Unit

✔️

X

Down-stream

Ensures archived records are accessible, organized, and compliant with regulations.

Data Backup & Recovery

6.4

IT Infrastructure & Security

✔️

X

Up-stream

Provides system and data continuity during IT disruptions or disaster recovery.

Cybersecurity & Access Control

6.5

Cybersecurity Team / Security Vendors

✔️

✔️

Mutual

Protects information systems from breaches and ensures controlled access.

System Development & Enhancement

6.6

Internal Dev Team / Outsourced Developers

✔️

✔️

Mutual

Develops and improves systems based on operational needs and stakeholder feedback.

ICT Vendor Management

6.7

Procurement / Vendor Relations

✔️ ✔️ Mutual

Coordinates and governs service contracts, performance, and support levels.

User Training & Support

6.8

IT Helpdesk / Learning & Development

✔️ X Down-stream

Provides training and support to end-users for system use and digital literacy.

Compliance & IT Governance

6.9

Risk & Compliance Unit / Internal Audit

✔️ X Down-stream

Ensures IT activities align with legal, regulatory, and policy frameworks.

Physical Records Handling

6.10

Facilities / Admin Services / Records Vendor

✔️ ✔️ Mutual

Maintains and retrieves physical records critical to business operations and compliance.

 

 

 

Summing Up ... Part 5

Interdependencies form the hidden network that holds business operations together.

When disruptions occur, these linkages can either amplify the impact or provide critical pathways for recovery, depending on how well they are understood and managed. By systematically mapping out dependencies, organisations strengthen their ability to respond to crises in a coordinated, informed manner.

This chapter has equipped readers with a framework to recognise, evaluate, and document dependencies at both strategic and operational levels. Ultimately, this clarity supports not only better recovery planning but also improves decision-making across the enterprise.

 

BIA Questionnaires 

Part 6: Vital Records

Notes for BCM Institute's Course Participants: This is the template for completing the "Part 6: Vital Records."

 

CBF 6: Information Systems & Records Management

Vital records are critical to the continuity and recovery of business operations in the event of a disruption.

For Bandtree, the CBF-6: Information Systems & Records Management function supports all corporate and operational tasks by ensuring that essential digital and physical records are protected, accessible, and recoverable.

This includes managing infrastructure, software systems, data integrity, cybersecurity, compliance, and safeguarding sensitive documentation.

Given Bandtree's role in managing Brunei’s strategic corporate property assets, the availability, confidentiality, and integrity of ICT systems and records are vital to its operations.

This section identifies the vital records across the sub-processes within CBF-6, categorising them based on media type, storage location, and designated custodians to support a structured and resilient approach to records protection and recovery.

Purpose of Chapter

This chapter outlines the types of vital records associated with each sub-process within CBF-6, including their formats, storage locations, and custodianship.

Emphasis is placed on both physical and digital recordkeeping practices to ensure redundancy, traceability, and secure access.

Based on the sub-processes (Sub-CBF) of CBF-6: Information Systems & Records Management for Bandtree, and following the structure for documenting Vital Records as referenced from BCM Institute's guidance notes, this is the table:

Table 6: [BIA] [P6] Vital Records for CBF 6: Information Systems & Records Management

 

Sub-CBF

Sub-CBF Code

Description of Vital Records

Media Type

Location

In Whose Care

ICT Infrastructure Management

6.1

Network diagrams, system configuration files, and equipment inventory

Digital (cloud/local)

On-premise server room; Cloud backup (e.g. AWS, Azure)

ICT Manager

Property Systems Application Support

6.2

Application source code, licensing records, system access logs

Digital

Central IT Repository; Cloud repository

Application Support Lead

Records Retention & Archiving

6.3

Document retention schedules, archived reports, and metadata indexes

Physical & Digital

Records Room; SharePoint Archive System

Records Management Officer

Data Backup & Recovery

6.4

Backup schedules, restoration logs, encrypted backup copies

Digital

Offsite backup facility; Cloud storage (e.g. OneDrive/Cloud)

IT Operations Lead

Cybersecurity & Access Control

6.5

Access control lists (ACLs), cybersecurity policies, and audit trails

Digital

Cybersecurity folder; Secure local drives

Cybersecurity Officer

System Development & Enhancement

6.6

Development plans, change logs, and test reports

Digital

Development server; Project documentation portal

System Analyst

ICT Vendor Management

6.7

Vendor contracts, service level agreements (SLAs), and contact list

Physical & Digital

Procurement Office; Vendor Management System

Procurement Officer / ICT PM

User Training & Support

6.8

Training manuals, user feedback logs, support ticket history

Digital

Knowledge Base platform; Helpdesk System

ICT Helpdesk Lead

Compliance & IT Governance

6.9

IT audit reports, compliance checklists, policy documents

Physical & Digital

Compliance folder (shared drive); Secure cabinet

IT Compliance Officer

Physical Records Handling

6.10

Physical records, logs, movement forms, access authorisations

Physical

Records Room, HQ Level 4

Records Custodian

 

 

Summing Up ... for Part 6

The classification and safeguarding of vital records under CBF-6 ensures that Bandtree’s digital and physical information assets remain protected and accessible during disruptions.

Proper identification of responsible custodians, storage locations, and record formats allows for efficient recovery of services and preserves the trust of stakeholders and clients.

By maintaining an up-to-date inventory of vital records and aligning with best practices in IT governance and compliance, Bandtree reinforces its operational resilience and commitment to national infrastructure stability.

As technology evolves, so too must our methods for securing the information lifelines that sustain our critical business functions.

 

Implementing Business Continuity Management for Bandtree: A Practical Guide
eBook 3: Starting Your BCM Implementation
MBCO P&S RAR T1 RAR T2 RAR T3 BCS T1  CBF
CBF 6: Information Systems & Records Management
DP BIAQ T1 BIAQ T2 BIAQ T3 BCS T2 BCS T3 PD

 

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the  BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].

 

 

Please feel free to send us a note if you have any questions.