[BCM] [BT] [E4] [R] [BIA] [P1] Identification of Business Functions for CBF-1 to CBF-8

[Part 1] Identification of Business Functions

Management Report for Identification of Business Functions

Objective & Scope

The goal of Part 1 is to systematically identify and catalogue Bandtree’s Critical Business Functions (CBFs) and their underlying sub-functions, and to define the associated Minimum Business Continuity Objective (MBCO) for each.

This foundational work sets the stage for subsequent impact analysis, dependency mapping, and recovery planning.

Bandtree has been assessed to have eight core CBFs:

1. Asset & Facilities Management
2. Infrastructure Operations
3. Client & Stakeholder Management
4. Billing, Finance & Vendor Management
5. Compliance, Governance & Reporting
6. Information Systems & Records Management
7. Human Resources & Payroll
8. Procurement & Supply Chain Management

Each CBF is broken down into sub-functions, with a line item for each sub-function’s continuity requirement (i.e. the MBCO) under disruption conditions.

Summary of Key Business Functions and MBCOs

Below is a distilled summary of each CBF, its primary sub-functions, and their defined MBCOs (i.e. the minimum acceptable level of continued activity during a disruption) — ordered from highest strategic importance:

CBF-1: Asset & Facilities Management

• Sub-functions include property/facility maintenance; asset condition monitoring; space planning; vendor/contractor oversight; HSSE (Health/Safety/Security/Environment); utilities management; emergency response; capital projects oversight; tenant/stakeholder liaison; and regulatory compliance reporting.
• The MBCO targets maintaining essential maintenance, monitoring critical assets, ensuring safety, sustaining vendor support, and preserving statutory compliance even under stress.

CBF-2: Infrastructure Operations

• Covers restoration of engineering operations,  physical security, utilities, emergency response, vendor coordination, monitoring dashboards, project coordination, space planning updates, compliance monitoring, and sustainability oversight.
• MBCOs are tighter (e.g. restore critical engineering in 4 hours, security surveillance within 30 minutes, utilities within 2 hours, etc.) to limit operational downtime\

CBF-3: Client & Stakeholder Management

• Key sub-functions include managing critical client requests, liaising with government regulators, ensuring continuity of essential contractor services (e.g., security, cleaning), issuing public communications/advisories, providing internal stakeholder updates, and maintaining access to stakeholder records. 
• The MBCO emphasises prompt response (e.g. within 24 hours) to maintain trust and preserve stakeholder confidence.

CBF-4: Billing, Finance & Vendor Management

• Encompasses customer billing & invoicing; payment collection & reconciliation; accounts payable; financial reporting; vendor onboarding/contracting; compliance & regulatory management; and risk/insurance administration. 
• MBCOs span from 24 to 72 hours for core processes, and up to days for non-critical reporting or vendor contracting, with interim tracking where possible. 

CBF-5: Compliance, Governance & Reporting

• Includes regulatory & legal compliance; internal audit & risk oversight; corporate governance monitoring; ESG reporting; BCM program continuity; and strategic/statutory reporting.
• MBCOs ensure preservation of the compliance framework, maintenance of audit trails, and fulfilment of reporting requirements during crises.

CBF-6: Information Systems & Records Management

• Comprises ICT infrastructure recovery; property systems support; records archival & retention; data backup & recovery; cybersecurity & access control; system development; ICT vendor management; user support/training; IT governance; and handling physical records. 
• MBCOs are very stringent here (e.g., restore infrastructure within 24 hours; data backups accessible within 4 hours; records accessible within 12 hours; minimal tolerance for extended cybersecurity downtime).

CBF-7: Human Resources & Payroll

• Subjects include staff recruitment, employee records access, payroll processing, employee benefits, performance management, training, HR policy compliance, and industrial relations/grievances.
• MBCO focuses on sustaining core HR operations, such as payroll and staff support, with non-critical programs deferred unless they carry contractual or compliance risks.

CBF-8: Procurement & Supply Chain Management

• Sub-functions: vendor prequalification/availability; contract management; essential procurement approval workflows; supplier relationship management; inventory & logistics coordination; procurement compliance & governance; risk tracking in supply chain; emergency procurement; and system/data reinstatement.
• MBCOs call for rapid turnaround (e.g. critical procurement activation within 4 hours, contract access within 24 hours, inventory & logistics within 24–48 h, supplier risk tracking within 72 h). 

Observations & Key Takeaways

• Tiered urgency across CBFs
  The MBCOs reflect graduated levels of urgency: for example, infrastructure and IT functions (CBF-2, CBF-6) demand very rapid recovery, whereas some governance or programme reporting functions allow slightly longer tolerances.

• Coverage of cross-cutting enabling functions
  Several sub-functions span multiple CBFs (e.g., vendor/contractor management, compliance, stakeholder communication). These represent critical dependencies that link functions together.

• Granularity supports downstream analysis.
  The sub-function breakdown provides a solid basis for dependency mapping (e.g. which technology, staffing, vendor resources each sub-function depends on) and for quantifying impacts in financial, operational, reputational, or regulatory terms.

• MBCO as a design anchor
  Defining these minimum tolerance thresholds ensures that recovery planning and resource allocation are anchored in realistic expectations, thereby reducing ambiguity in later phases (e.g., in recovery strategy, resource requirement definition, or invocation criteria).

• Foundation for prioritisation and investment
  With the CBFs and MBCOs clearly laid out, management can more easily prioritise which functions must receive the highest resilience investment (e.g. backup infrastructure, redundant vendors, emergency procurement capacity) in proportion to their criticality and tolerance windows.

Summing Up ...

Implementing Business Continuity Management for Bandtree: A Practical Guide
eBook 4: Consolidate and Report Your BCM Implementation
[P1] Business Unit MBCO for CBF-1 to CBF-8

To learn more about the course and schedule, click the buttons below for the  BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].

 

	Please feel free to send us a note if you have any questions.