[BCM] [JCUS] [E1] [C1] Overview of BCM Case Study

Building Business Continuity Resilience  for JCUS

 

Introduction

James Cook University Singapore operates in an environment where the continuity of education depends upon much more than the availability of classrooms.

Academic staff, students, learning technologies, student records, assessment processes, campus facilities, communications, third-party services and regulatory arrangements collectively support the University's ability to deliver education.

A serious disruption affecting any combination of these resources can quickly become an institutional continuity issue.

Examples include a cyberattack affecting student and academic systems, an extended campus closure, loss of telecommunications, failure of a critical cloud service, prolonged power disruption, infectious-disease events, loss of key personnel or an incident affecting the integrity of academic records.

Business Continuity Management (BCM) provides JCUS with a structured approach for preparing for such disruptions and maintaining its priority activities at acceptable levels.

ISO 22301:2019 is the current published international requirements standard for Business Continuity Management Systems (BCMS).

It provides a framework for establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving a BCMS so an organisation can prepare for, respond to, and recover from disruptions.

A new edition is under development as of September 2026, but ISO 22301:2019 remains the published edition. ISO

For JCUS, BCM should be treated as an institutional management capability rather than merely an emergency-response plan.

Its purpose is to protect the continued delivery of education and other priority activities while safeguarding students, employees, information, academic integrity, regulatory obligations and institutional confidence.

This opening chapter establishes the foundation for the remainder of Understanding Your Organisation for James Cook University. It introduces ten interconnected areas:

1. Introducing BCM for JCUS
2. Understanding JCUS's Operations
3. Identifying BCM Goals for JCUS
4. Establishing Business Continuity Objectives for JCUS
5. Determining Business Continuity Assumptions for JCUS
6. Developing the BCM Team Composition for JCUS
7. Analysing the Operating Environment for JCUS
8. Implementing the BCM Planning Methodology
9. Assessing Risks and Threats for JCUS
10. Identifying Critical Business Functions for JCUS

Together, these establish the organisational context needed before detailed BIA, continuity strategy, plan development, exercising and programme management can be undertaken.

 

Introducing BCM for James Cook University

BCM is the coordinated organisational capability that enables JCUS to prepare for disruptions, respond effectively when they occur, maintain priority activities and recover affected operations.

The emphasis is on continuity of outcomes, rather than simply recovery of individual assets.

For example, if the Sims Drive campus becomes temporarily inaccessible, the BCM objective is not necessarily to restore the building immediately.

The immediate continuity requirement may instead be to maintain an acceptable level of teaching, assessment, student support and communication through alternative arrangements.

Likewise, if LearnJCU or another critical academic platform becomes unavailable, the objective should extend beyond restoring the application. JCUS should determine how affected teaching and academic activities can continue while technical recovery is underway.

A practical JCUS BCM philosophy is therefore:

Protect people. Maintain priority education services. Protect academic information and integrity. Meet essential obligations. Recover systematically. Learn and improve.

This aligns with ISO 22301's emphasis on an organisation's ability to continue delivering products and services at an acceptable predefined capacity during disruption.

BCM Is More Than Emergency Management

 Emergency management and BCM are related but perform different functions.

An emergency response may focus on evacuating a building following a fire. BCM addresses the subsequent question:

How will JCUS continue its priority activities if the building remains unavailable for two weeks?

Similarly, cybersecurity teams may contain a ransomware incident. BCM asks:

How will teaching, assessment, student administration and other priority activities operate while systems are unavailable or being restored?

The JCUS BCMS should therefore integrate with, rather than replace:

• emergency response;

• crisis management;

• ICT disaster recovery;

• cybersecurity incident response;

• facilities management;

• health and safety;

• academic management;

• student support;

• communications;

• risk management; and

• third-party management.

 

Understanding JCUS's Operations

Effective BCM starts with understanding the organisation.

ISO 22301 places organisational context at the beginning of the management-system process.

This includes understanding internal and external issues, interested parties, applicable requirements and the scope of the BCMS.

For JCUS, the operating model spans several interconnected domains.

 

Operational Domain	Examples Relevant to JCUS	BCM Consideration
Academic delivery	Lectures, tutorials, practical teaching	How can teaching continue during campus or technology disruption?
Assessment	Assignments, examinations, marking and results	Which assessment activities are time-critical?
Student administration	Admission, enrolment, progression and records	How long can these activities be unavailable?
Student services	Advice, welfare and essential support	Which services must remain accessible during disruption?
Digital learning	LearnJCU and associated academic technologies	What alternatives exist if platforms become unavailable?
ICT	Networks, identity, applications, devices and connectivity	Which technologies support priority activities?
Campus	Teaching spaces, laboratories, library and facilities	What happens if the campus is inaccessible?
Academic information	Student records, results and teaching information	How are availability and integrity protected?
Research	Research information, specialist facilities and activities	Which research activities are time-sensitive or irreplaceable?
Regulatory and quality assurance	Private education and EduTrust obligations	Which obligations have fixed deadlines or continuity implications?

The important BCM principle is that these domains are interdependent.

Teaching, for example, may require academic staff, ICT connectivity, authentication, learning platforms, student enrolment information, learning resources, physical or virtual teaching facilities and communication channels.

JCUS should therefore understand services as end-to-end institutional activities rather than isolated departmental processes.

 

Singapore Regulatory and Quality-Assurance Context

JCUS operates within Singapore's private education regulatory and quality-assurance framework.

As of September 2026, JCUS states that the functions and powers under the Private Education Act 2009 and its subsidiary legislation transferred to the Skills and Workforce Development Agency (SWDA) from 1 July 2026 following the merger of SkillsFuture Singapore Agency and Workforce Singapore Agency.

 JCUS also states that all courses at its Singapore campus are registered with SWDA and its operations are governed by EduTrust. James Cook University Singapore

SWDA administers EduTrust as the quality-assurance scheme for Private Education Institutions. JCUS states that it holds EduTrust Star, the highest level of the scheme, and obtained this award for the third time in 2023. James Cook University Singapore

EduTrust includes seven assessment criteria, beginning with Leadership and Strategic Planning, and is intended to support higher standards of educational services and student or graduate outcomes. SSG

The regulatory environment has direct implications for BCM. Continuity arrangements should therefore consider, where applicable:

    • requirements under the Private Education Act and subsidiary legislation;
    • SWDA requirements;
    • EduTrust obligations;
    • student protection arrangements;
    • Fee Protection Scheme requirements;
    • academic and student records;
    • student contractual obligations;
    • data protection requirements;
    • safety obligations; and
    • regulatory reporting and evidence.

For example, JCUS states that its students are covered under a Fee Protection Scheme and that it uses the Fee Protection Scheme Group Insurance arrangement. James Cook University Singapore

This means that BCM should not be designed solely around operational recovery. 

It should also consider whether prolonged disruption could impair JCUS's ability to meet regulatory, quality-assurance and student-protection obligations.

 

Identifying BCM Goals for JCUS

BCM goals describe what JCUS ultimately seeks to achieve through its continuity programme.

They should align with institutional priorities rather than being limited to technical recovery.

Recommended BCM goals for JCUS include:

 

BCM Goal	Application to JCUS
Protect life, safety and welfare	Safeguard students, employees, contractors and visitors during disruptive incidents.
Maintain priority education activities	Continue critical teaching, assessment and academic activities at acceptable levels.
Protect students	Minimise disruption to learning, progression, assessment and essential support.
Maintain academic integrity	Protect examinations, results, academic information and assessment processes.
Protect information	Maintain confidentiality, integrity and availability of critical information.
Maintain regulatory obligations	Support continued compliance with applicable Singapore requirements.
Maintain stakeholder confidence	Provide timely, accurate and consistent information during disruption.
Protect institutional reputation	Demonstrate controlled and responsible management of significant incidents.
Enable structured recovery	Restore affected operations according to agreed priorities.
Continually improve resilience	Learn from incidents, exercises, audits and organisational change.

These goals provide direction for the more measurable business continuity objectives.

 

Establishing Business Continuity Objectives for JCUS

BCM goals express intent. Business continuity objectives translate that intent into measurable outcomes.

ISO 22301 emphasises establishing objectives that support the business continuity policy and allow the organisation to evaluate BCMS effectiveness. ISO

Illustrative JCUS objectives could include:

Objective 1 — Maintain Priority Teaching

Establish continuity arrangements that allow priority teaching activities to continue at an agreed minimum level following loss of normal teaching facilities or technologies.

Objective 2 — Protect Critical Assessment Activities

Establish alternative arrangements for examinations and assessments where disruption would otherwise create unacceptable academic consequences.

Objective 3 — Recover Critical ICT Services

Define recovery requirements for technologies supporting priority university activities and align ICT disaster recovery capabilities with BIA requirements.

Objective 4 — Maintain Student Communications

Provide reliable mechanisms for communicating disruption information and continuity arrangements to affected students.

Objective 5 — Maintain Critical Student Support

Ensure that essential welfare and student-support arrangements remain available during serious disruptions.

Objective 6 — Exercise Continuity Arrangements

Conduct planned exercises that validate business continuity procedures, responsibilities, communications, dependencies and decision-making.

Objective 7 — Continually Improve the BCMS

Capture corrective actions arising from incidents, exercises, audits and management reviews and track them through completion.

These objectives should subsequently be supported by indicators, accountable owners and review periods.

 

Determining Business Continuity Assumptions for JCUS

Develop continuity plans against explicit assumptions.

Without agreed assumptions, different departments may prepare for fundamentally different disruption conditions.

JCUS should consider assumptions such as:

 

Planning Assumption	Example
Campus loss	Part or all of Sims Drive may be inaccessible for an extended period.
Technology disruption	One or more critical applications may be unavailable even where staff can work remotely.
Cyber incident	Systems may need to remain isolated until they are confirmed safe.
Workforce disruption	A significant proportion of employees may be unavailable or unable to reach campus.
Communications disruption	Normal email, telephony or collaboration tools may not always be available.
Third-party disruption	A critical supplier may fail when JCUS needs its services.
Data integrity issue	Information may be accessible but may not be initially trustworthy.
Peak-period incident	Disruption may occur during examinations, enrolment or another time-sensitive academic period.
Prolonged disruption	Recovery may take substantially longer than expected.
Concurrent events	JCUS may have to manage more than one disruption at the same time.

 

A useful planning principle is:

Do not assume the resource that failed will be available to support the workaround.

For example, an ICT continuity plan should not rely exclusively on the same authentication infrastructure that failed and caused the original disruption.

 

Developing the BCM Team Composition for JCUS

BCM requires clearly defined governance and accountability.

Under ISO 22301, top management plays an important role in providing leadership, establishing policy, ensuring resources are available, and assigning responsibilities for implementing and maintaining the BCMS.

A practical JCUS BCM structure could comprise:

 

BCM Role	Primary Responsibility
Senior Management	Strategic oversight, policy approval and resources
BCMS Sponsor	Executive sponsorship and escalation
BCM Steering Committee	Institutional BCM governance and prioritisation
BCM Programme Lead	Coordinate and maintain the BCMS
Academic Representatives	Teaching, assessment and academic continuity
Student Administration Representatives	Student records, enrolment and progression
Student Support Representatives	Student welfare and essential support
ICT / Cybersecurity	Technology resilience, cyber response and disaster recovery
Facilities / Campus Operations	Campus availability, utilities and alternative facilities
Communications	Student, staff and stakeholder communications
Human Resources	Workforce continuity and staff welfare
Finance	Critical financial processes and resources
Regulatory / Quality Representatives	Regulatory and EduTrust considerations
Business Function Owners	BIA, strategies and continuity procedures for individual functions

The BCM team should not own every recovery activity.

A useful accountability principle is:

BCM coordinates the framework; business owners own continuity of their functions.

 

Analysing the Operating Environment for JCUS

The operating environment influences both the types of disruptions JCUS should consider and the continuity capabilities it requires.

The analysis should consider external and internal factors.

External Environment

Relevant factors may include:

• Singapore's regulatory framework;
• expectations of students and parents;
• dependence on telecommunications and utilities;
• cloud and technology providers;
• cyber threats;
• severe weather and environmental conditions;
• public-health events;
• transport disruption;
• critical suppliers;
• international dependencies; and
• changes affecting the higher-education sector.

Internal Environment

Relevant considerations include:

• academic calendar;
• student population;
• workforce;
• campus configuration;
• teaching delivery model;
• ICT architecture;
• learning platforms;
• academic governance;
• specialist facilities;
• information dependencies;
• organisational structure;
• third-party arrangements; and
• existing incident-management capabilities.

The assessment should also identify interested parties.

For JCUS, these may include students, employees, regulators, parents, partner organisations, suppliers, insurers and other stakeholders.

Each may have different continuity expectations.

 

Implementing the BCM Planning Methodology

For this implementation guide, the BCM planning methodology consists of seven phases:

• Project Management (PM)

• Risk Analysis and Review (RAR)

• Business Impact Analysis (BIA)

• Business Continuity Strategy (BCS)

• Plan Development (PD)

• Testing and Exercising (TE)

• Programme Management (PgM)

 

ACF should implement BCM as a structured lifecycle, not a collection of standalone emergency plans.

A practical methodology contains seven major phases.

Phase 1 — Project Management

Establish governance, policy, roles, responsibilities, scope and programme management arrangements.

Phase 2 — Risk Assessment

Identify threats, vulnerabilities, existing controls and potential disruption scenarios.

Phase 3 — Business Impact Analysis

Determine critical activities, understand disruption consequences, and establish recovery priorities.

Phase 4 — Business Continuity Strategy

Identify practical solutions for meeting approved recovery requirements.

Phase 5 — Plan Development

Document activation, response, continuity and recovery procedures.

Phase 6 — Testing and Exercising

Validate whether the arrangements work under realistic disruptive conditions.

Phase 7 — Programme Management and Continual Improvement

Review incidents, exercises, organisational changes and performance to continually improve the BCMS.

The methodology should operate as a continuous management cycle rather than a one-time project.

Example

Consider an extended failure of a critical learning platform.

The methodology would require JCUS to:

Risk Analysis and Review (RAR)—identify plausible causes such as a cyberattack, cloud outage, or authentication failure.
Business Impact Analysis (BIA) — determine which teaching and assessment activities are affected and when impacts become unacceptable.
BC Strategy (BCS) —identify alternative methods for distributing learning materials and receiving essential submissions.
Plan Development (PD) —document responsibilities, actions, escalation, and communication.
Exercise — simulate loss of the platform during a critical academic period.
Program Management (PgM) and Improvement — correct weaknesses discovered during the exercise.

BCM therefore becomes a lifecycle, not a collection of static documents.

 

Assessing Risks and Threats for JCUS

Risk assessment complements the BIA.

The risk assessment asks what could cause disruption.

The BIA asks what the consequences would be if disruption occurs and how quickly recovery is required.

Both are necessary.

Illustrative threats for JCUS include:

 

Threat Category	Example Threats	Potential JCUS Impact
Cyber	Ransomware, account compromise, DDoS	Loss of academic and administrative systems
ICT	Application, network or authentication failure	Loss of digital learning and administration
Data	Corruption or loss of records	Academic and student-record integrity issues
Facilities	Fire, utility failure, building damage	Campus or facility unavailability
Utilities	Extended electricity or telecommunications outage	Teaching and ICT disruption
People	Pandemic, workforce shortage, loss of specialist staff	Reduced ability to deliver critical activities
Supplier	Cloud or critical service-provider failure	Loss of outsourced capabilities
Security	Threat affecting campus access	Evacuation or denial of access
Environmental	Severe weather or environmental incident	Campus and transportation disruption
Academic	Examination or assessment disruption	Student progression and integrity consequences

Risk treatment can reduce the probability or impact of some disruptions.

However, BCM should recognise that it cannot prevent every disruption.

The central continuity question therefore remains:

If the preventive controls fail, can JCUS still maintain its priority activities?

 

Identifying Critical Business Functions for JCUS

Critical Business Functions (CBFs) are activities whose disruption could create unacceptable consequences if they are not continued or recovered within the required timeframe.

Criticality should be based on impact over time, rather than organisational status or departmental preference.

For example, routine administrative activities may tolerate several days of disruption. In contrast, examination activities during a scheduled examination period may become critical within hours.

An initial enterprise-level JCUS CBF catalogue could include:

 

CBF	Proposed Critical Business Function
CBF-1	Teaching and Learning Delivery
CBF-2	Examinations and Academic Assessment
CBF-3	Student Enrolment, Registration and Academic Progression
CBF-4	Student Records and Academic Results Management
CBF-5	Critical Digital Learning and Academic Platforms
CBF-6	Critical ICT Infrastructure, Identity and Connectivity
CBF-7	Student Safety, Welfare and Critical Support
CBF-8	Campus Safety, Security and Essential Facilities
CBF-9	Admissions and Critical Student Onboarding
CBF-10	Student Fee Administration and Protection
CBF-11	Regulatory Compliance and Education Quality Assurance
CBF-12	Critical University Communications and Crisis Information
CBF-13	Library and Essential Academic Information Resources
CBF-14	Critical Research and Specialist Laboratory Operations

These classifications are proposed BCM working categories and should be validated through JCUS's formal BIA rather than interpreted as existing JCUS classifications.

Academic Calendar Criticality

A distinctive characteristic of university BCM is that criticality changes throughout the academic year.

During an intake period, admissions, enrolment, student systems and fee administration may become particularly time-sensitive.

During normal teaching weeks, teaching delivery, LearnJCU, ICT, student support and campus facilities may take priority.

During examinations, assessment, ICT, student records, facilities and communications may become exceptionally time-critical.

During results processing, academic records, assessment results and progression decisions become important.

JCUS should therefore incorporate peak-period criticality into its BIA rather than assigning one static recovery priority to each function.

 

Connecting the Ten BCM Components

The ten components discussed in this chapter should not be implemented independently.

They form an integrated sequence:

Understand JCUS and its regulatory context

This establishes what the organisation does, whom it serves and what obligations apply.

Define BCM goals and objectives

This establishes what resilience outcomes JCUS intends to achieve.

Establish assumptions and governance

This determines the conditions against which continuity will be planned and who is responsible.

Analyse the operating environment

This identifies internal and external dependencies and constraints.

Apply the BCM planning methodology

This provides the structured process for implementation.

Assess risks and threats

This identifies plausible causes of disruption.

Identify Critical Business Functions

This determines which activities require priority protection and recovery.

The subsequent BIA can then determine how quickly those functions need to be recovered and what resources they require.

 

What Effective BCM Should Look Like at JCUS

A mature JCUS BCMS should ultimately allow management to answer several practical questions confidently:

• Which university activities must continue during a serious disruption?

• How long can each priority activity tolerate interruption?

• What is the minimum acceptable operating level?

• Which people are essential?

• Which systems and information are required?

• Which facilities are required?

•  Which suppliers and external parties are critical?

•  What alternative arrangements are available?

•  Who has authority to activate continuity arrangements?

•  How will students and employees be informed?

•  How will ICT recovery priorities align with business priorities?

•  How will JCUS know that its plans actually work?

• How will weaknesses be corrected?

Exercises and tests are particularly important because they provide evidence about whether continuity arrangements work as intended.

ISO guidance emphasises structured exercises to validate arrangements and build organisational capability. ISO

BCM maturity should therefore be measured not by the number of plans JCUS possesses but by its demonstrated ability to continue and recover priority activities under realistic disruption conditions.

 

Relationship to the Three-eBook Series

This three-eBook series takes ACF through a progressive BCM implementation journey.

This chapter also establishes the foundation for the complete series:

eBook 1 — Understanding Your Organisation for James Cook University

Establishes organisational context, BCM goals and objectives, assumptions, governance, operating environment, threats and Critical Business Functions.

eBook 2 — Implementing Business Continuity Management for James Cook University

Translates organisational understanding into detailed risk assessment, BIA, continuity strategies, recovery requirements, procedures, exercising and implementation activities.

eBook 3 — Starting Your BCM Implementation for James Cook University

Provides a practical implementation pathway for turning the methodology into an operational JCUS BCM programme, including ownership, implementation activities, templates, workshops and continuous improvement.

Together, the three eBooks move the reader from:

Understanding → Analysis → Strategy → Planning → Validation → Sustained BCM Capability

 

Business Continuity Management provides James Cook University Singapore with a structured way to prepare for disruption while protecting the continued delivery of priority education and institutional activities.

For JCUS, BCM must extend beyond recovering buildings or technology. Effective continuity depends upon understanding the relationships between students, academic staff, teaching and assessment, information, digital platforms, ICT infrastructure, campus facilities, student support, suppliers and regulatory obligations.

The Singapore context is also important.

JCUS operates under the Private Education Act framework, with SWDA exercising relevant regulatory functions since 1 July 2026, and operates within the EduTrust quality-assurance environment.

JCUS states that its Singapore courses are registered with SWDA and that EduTrust governs its operations.

ISO 22301 provides the management-system foundation for integrating these considerations into a coherent BCMS.

It requires more than producing continuity plans: the organisation must establish context, leadership, objectives, resources, operational arrangements, evaluation, and continual improvement. 

The practical foundation established in this chapter can therefore be summarised as:

For JCUS, the desired outcome is an institutional capability that enables the University to protect people, maintain priority educational activities, safeguard students and academic integrity, meet essential obligations, communicate effectively, recover systematically and continually strengthen resilience.

Blogs marked [x] are under construction