---
title: [BCM] [BIA] [ISO22301] [P4] Supporting IT Systems and Applications
description: [BCM] [SHINE] [E4] [CR] [BIA] [P4] Supporting IT Systems and Applications for CBF-1 to CBF-12
image: https://blog.bcm-institute.org/hubfs/BIA%20Morepost/Assignment%20%5BB%5D%20BIA%20Morepost%20Sample%20Answers/IC_BCM%20BIA_Part%205_Supporting%20IT%20Systems%20and%20Applications.png
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
##### Ebook Series
# \[BCM\] \[BIA\] \[ISO22301\] \[P4\] Supporting IT Systems and Applications
Under ISO 22301:2019, organisations are required to identify and assess resources that support prioritised activities, including information, communication systems, applications, and infrastructure (Clause 8.2.2 – Business Impact Analysis).
**Part 4: Supporting IT Systems and Applications** is a critical component of the Business Impact Analysis (BIA) that documents the **technology dependencies** required for each business function.
This chapter ensures that IT recovery requirements are directly aligned with **business recovery priorities**, enabling effective planning for disaster recovery, technology resilience, and operational continuity.
By completing Part 4, organisations establish a structured link between **business function recovery objectives** and **ICT recovery capabilities**, as required by ISO 22301, and provide essential inputs for IT disaster recovery planning, third-party management, and resilience testing.
[![Banner \[BCM\] \[E3\] \[BIA\] \[Summing Up\] \[P4\] Supporting IT Systems and Applications \[BIAQ\]](https://no-cache.hubspot.com/cta/default/3893111/9bde2d75-0c8e-4d9e-a8ca-e8d1655a082c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9bde2d75-0c8e-4d9e-a8ca-e8d1655a082c)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook/author/dr-goh-moh-heng) Jan 18, 2026
###### Business Continuity Management Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a1b4b4e2-f0aa-44df-a197-431397a7927c)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/58912f86-0de7-4b16-bcf9-99bdedd6b04d)
### [![Banner \[BCM\] \[E3\] \[BIA\] \[P4\] Supporting IT Systems and Applications](https://no-cache.hubspot.com/cta/default/3893111/e60ed308-5615-4727-b6c2-5fb4eed933d7.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e60ed308-5615-4727-b6c2-5fb4eed933d7)Supporting IT Systems and Applications (Aligned with ISO 22301 BCMS)
Modern organisations rely heavily on information and communication technology (ICT) to deliver products and services.
Under ISO 22301:2019, organisations are required to identify and assess resources that support prioritised activities, including information, communication systems, applications, and infrastructure (Clause 8.2.2 – Business Impact Analysis).
**Part 4: Supporting IT Systems and Applications** is a critical component of the Business Impact Analysis (BIA) that documents the **technology dependencies** required for each business function.
This chapter ensures that IT recovery requirements are directly aligned with **business recovery priorities**, enabling effective planning for disaster recovery, technology resilience, and operational continuity.
By completingPart 4, organisations establish a structured link between **business function recovery objectives** and **ICT recovery capabilities**, as required by ISO 22301, and provide essential inputs for IT disaster recovery planning, third-party management, and resilience testing.
---
#### **Rewritten Objectives of Part 4 (Aligned with ISO 22301)**
The objectives of **Part 4: Supporting IT Systems and Applications** are to:
1. **Identify and document ICT resources supporting each business function**
In accordance with ISO 22301 Clause **8.2.2**, this includes applications, systems, data repositories, and enabling technologies required to perform prioritised activities.
2. **Determine ICT recovery requirements aligned with business needs**
This section captures **Recovery Time Objectives (RTOs)** and **Recovery Point Objectives (RPOs)** for systems, ensuring alignment with the supporting business function's maximum tolerable disruption (MTD).
3. **Support continuity and disaster recovery strategy development**
The information collected provides essential input for Clause **8.3 – Business Continuity Strategies and Solutions**, enabling informed decisions on backup solutions, redundancy, system replication, and recovery architecture.
4. **Highlight critical technology dependencies and constraints**
This includes shared systems, specialised equipment, third-party platforms, and cloud or outsourced services that may affect recovery capability and response coordination.
5. **Facilitate assurance, testing, and continual improvement**
Accurate system dependency data supports ICT recovery testing, exercises, and post-incident reviews required under Clauses **8.5** and **10** of ISO 22301.
---
### **Rewritten Content Description (ISO 22301–Enhanced)**
When completing **Part 4: Supporting IT Systems and Applications**, the business function owner, in collaboration with IT and continuity stakeholders, should capture the following information:
#### **1. Business Function and Function Code**
Each entry must reference a business function previously identified and prioritised in **Part 1 of the BIA**, ensuring traceability between business activities and their supporting ICT resources, as required by ISO 22301 Clause **8.2.2**.
---
#### **2. Supporting IT Systems and Applications**
List all **applications, systems, platforms, or shared services** required for the business function to operate, including:
- Core business applications (e.g. ERP, CRM, core banking systems)
- Collaboration and communication systems
- Databases and document management systems
- Cloud-based or outsourced platforms
Where applicable, indicate:
- Whether the system is internal or externally hosted
- Approximate number of users required during recovery
- Any system criticality or prioritisation notes
This ensures a complete understanding of ICT dependencies supporting prioritized activities.
---
#### **3. Recovery Point Objective (RPO)**
The RPO defines the **maximum acceptable data loss**, measured in time.
In line with ISO 22301, the RPO must:
- Reflect business tolerance for data loss
- Be consistent with backup frequency and data protection controls
- Support regulatory, contractual, and operational requirements
---
#### **4. System Recovery Time Objective (System RTO)**
The system RTO specifies the **maximum time allowed to restore the system** to an operational state following disruption.
The stated RTO must:
- Support the RTO of the associated business function
- Be realistic based on current ICT capabilities
- Inform disaster recovery prioritisation and recovery sequencing
---
#### **5. Supporting Special Equipment or ICT Resources**
Identify any **specialised equipment or technology resources** required to operate or access the system, such as:
- Secure workstations or terminals
- Printers, scanners, or network devices
- Authentication tools or encryption devices
This supports ISO 22301 requirements for identifying **resource dependencies and constraints**.
---
#### **6. Remarks and Assumptions**
Use this section to capture:
- Dependencies on third-party service providers
- Known recovery limitations or manual workarounds
- Licensing, access, or security constraints
- Any assumptions made during the assessment
Clear documentation of assumptions supports auditability and continual improvement under ISO 22301 Clause **10**.
### [![Banner \[BCM\] \[E3\] \[BIA\] \[Summing Up\] \[P4\] Supporting IT Systems and Applications \[BIAQ\]](https://no-cache.hubspot.com/cta/default/3893111/9bde2d75-0c8e-4d9e-a8ca-e8d1655a082c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9bde2d75-0c8e-4d9e-a8ca-e8d1655a082c)
Part 4: Supporting IT Systems and Applications ensures that technology recovery requirements are firmly anchored to business priorities, fulfilling a core expectation of ISO 22301’s Business Impact Analysis process.
By systematically identifying ICT dependencies, defining RPOs and RTOs, and documenting recovery constraints, organisations gain the clarity needed to:
- Design effective IT disaster recovery and resilience strategies
- Align ICT recovery objectives with business continuity objectives
- Strengthen coordination between business, IT, and third-party providers
- Demonstrate compliance with ISO 22301 during audits and reviews
When combined with the other BIA components, this section enables organisations to build credible, measurable, and actionable continuity solutions, ensuring that critical business functions can be restored within acceptable timeframes following disruptive incidents.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/18938f2e-3b57-45f5-b266-76e5ca384bc9)
#### More Information About Business Continuity Management Courses
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer \[BCM-3\] and the BCM-5000 Business Continuity Management Expert Implementer \[BCM-5\].
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f3922b80-e96a-46d6-8993-dc150a5de2d5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9ff8a3dc-e39a-465b-929f-72e232cdd5fb) | [![Register \[BL-B-3\]*](https://no-cache.hubspot.com/cta/default/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ac6cf073-4cdd-4541-91ed-889f731d5076) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/21525c10-4003-4934-95fc-fe218174bc5b) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/46460171-c91a-4936-9bb2-8dc5928a0e02) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/1cb17ac7-50b2-4f88-bc4b-c7444e4b57b5) |
| [![FAQ \[BL-B-3\]](https://no-cache.hubspot.com/cta/default/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b3824ba1-7aa1-4eb6-bef8-94f57121c5ae) | Please feel free to send us a note if you have any questions. [![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/9c199ae8-c470-4bb7-9612-73c7a084e94c) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/8999211a-2c51-4be7-bf49-c393f6c67974) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5c1aa95d-f6dd-4067-a95c-5cc0c32d7ed8) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/086ab3b9-4d66-4a95-b2f7-1148e9803a9c) |
#### **Your Comments Here:**
### More Posts
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/839787f4-a4fd-456f-accf-54c947026558)
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook/author/dr-goh-moh-heng"
},
"dateModified" : "2026-01-18T14:07:31.610Z",
"datePublished" : "2026-01-18T13:53:05.000Z",
"headline" : "[BCM] [BIA] [ISO22301] [P4] Supporting IT Systems and Applications",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook/bcm-bia-iso22301-p4-supporting-it-systems-and-applications",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```