ISO 22301 Clause 7.2: Competence

Quick Reference (60 Seconds)

If you only read one thing: Clause 7.2 is where the BCMS is treated as a human-capability system rather than a documentation set. A 7.2-conformant BCMS is one in which the organisation has identified every role whose work affects the BCMS, has profiled the competence each role requires, has assessed every role-holder against that profile, has closed the gaps through training, hiring, mentoring or contracting, has captured the evidence under Clause 7.5 control, has measured whether the intervention worked, and feeds the competence portfolio into the management review every cycle. The certification auditor will examine this discipline ruthlessly, and so will a regulator after a disruption, when a BCMS fails, the second question after "what happened?" is always "were the people who executed the plan actually competent to do so, and where is the evidence?". Get 7.2 wrong and however strong the policy, the BIA and the plans, the BCMS will fail on the day it is activated because the people who must execute the plans cannot. Get it right and the BCMS becomes a system whose plans are matched by the people who will run them.

What the Standard Actually Requires

The paraphrased requirement

ISO 22301 Clause 7.2 asks organizations to make sure the people doing BCMS work are competent, through education, training, or experience, and to keep evidence of it. The clause sits inside Clause 7 (Support) and forms the human-capability spine of the BCMS. Three duties flow from the paraphrase, each of which an auditor will test independently.

Duty 1, Determine the necessary competence. The organisation must work out, in writing, what competence each BCMS-relevant role requires. "Necessary" is bounded by the work to be done, the BCM Manager's competence is determined by what the BCM Manager must do (run the programme, manage the BIA, design exercises, brief executives, liaise with regulators), the CMT Chair's competence is determined by what the CMT Chair must do (lead a crisis room under uncertainty, make delegation decisions, communicate to the board), the DR engineer's competence is determined by what the DR engineer must do (execute failover, validate data integrity, manage the supplier chain). Determination is a job-of-work analysis, not a CV analysis: the organisation starts from the work and derives the competence, not from the incumbent and reverse-engineers the requirement. This is the single most consequential design decision in 7.2 and the one Indian growing companies most often get wrong.

Duty 2, Take action to acquire the necessary competence. Where a gap exists between the required and the current competence, the organisation must act to close it. The clause identifies three routes, education (formal qualifications, degrees, diplomas), training (structured programmes that transfer skill, instructor-led, e-learning, simulation, on-the-job coaching), and experience (time-on-task in role, with the depth and variety the role needs). A mature organisation treats all three as a portfolio, a CISO may need a master's degree (education), the CISSP certification (training), five years of SOC leadership (experience) and three sector-specific drills a year (continuing experience). The action obligation is not satisfied by booking a course; it is satisfied by closing the demonstrated gap.

Duty 3, Retain Documented Information as evidence. Whatever competence exists must be evidenced. The clause requires the organisation to maintain documented information, that is, evidence under the control system of Clause 7.5, that demonstrates the competence exists. Evidence includes degrees and certificates (with verification), training attendance and assessment records, role descriptions, on-the-job assessment sign-offs, exercise-evaluator ratings, internal-audit observations, peer-review notes, regulatory-exam results, and statements of competence issued by competent third parties. Evidence is the auditor's window into the competence system; without it, the competence is asserted, not demonstrated.

What the standard does NOT require (the demarcation competitors miss)

Clause 7.2 is often conflated with neighbouring clauses. It is helpful to be explicit about what is out of scope for 7.2 itself, because auditors test the boundary:

• It does not require assigning the roles. That is Clause 5.3. 7.2 takes the roles that 5.3 has assigned and makes sure the people in them are competent; it does not authorise the appointment.
• It does not require funding the roles. That is Clause 7.1. 7.1 commits the resource; 7.2 makes the resource capable. A well-built BCMS treats them as a single workflow but the clauses are distinct.
• It does not require the whole workforce to be competent in BCM. That is Clause 7.3, awareness. 7.3 is the workforce-wide programme (every employee knows the policy, their role, the consequences of non-compliance). 7.2 is the role-specific competence regime for the people who do BCM work. A useful test: if the role appears in the BCM Role Taxonomy, it is 7.2; if it does not, it is 7.3.
• It does not require any specific certification. The clause does not mandate BCI, DRI, CISSP, CISA or any other certification by name. It requires the organisation to determine what competence is necessary and then to act; certifications are one route (often the most evidentially clean) but not the only one. A small organisation may legitimately determine that experience plus internal training is sufficient; a regulated bank will almost always require external certification for the BCM Manager and CISO roles.
• It does not require a learning management system (LMS). An LMS is a tool that helps manage competence at scale; it is not a requirement. At lower maturity a spreadsheet-based Competence Evidence Record under Clause 7.5 document control is sufficient.
• It does not require competence to be evidenced by a single central HR system. Evidence may be distributed across HR, BCM team files, supplier records and exercise reports; what matters is that it is discoverable, controlled, and traceable to a named role-holder.
• It does not require an annual training calendar. A calendar is the operational expression of the Training and Development Plan, but the clause requires actions to be taken where gaps exist, the cadence is gap-driven, not calendar-driven. Mature organisations run both: a calendar for the recurring baseline (drills, refreshers) and an event-driven pipeline for emerging gaps (post-incident, post-exercise, post-recruitment).

The companion guidance and adjacent standards

The clause text is short; the method lives in companion and adjacent standards. Both are paywalled; cite the current edition:

• ISO 22313:2020, Security and resilience, Business continuity management systems, Guidance on the use of ISO 22301. The clause-by-clause companion. Use it as the authoritative explanation of what 7.2 evidence should look like and how competence interlocks with the rest of the BCMS.
• ISO/TS 22330:2018, Security and resilience, Guidelines for people resilience. The dedicated people-resilience guidance: roles, responsibilities, competency, awareness, training, succession, welfare, and the people dimension of crisis response. Useful when designing the BCM Role Taxonomy.
• ISO/IEC 27001:2022 Clause 7.2, the Information Security Management System analogue, with the same Harmonized Structure. Useful for integrated audits and for evidencing competence across the ISO 27001 / 22301 stack.
• ISO 9001:2015 Clause 7.2, the Quality Management System analogue. Useful where the organisation has an integrated QMS/BCMS.
• ISO 30414:2018, Human resource management, Guidelines for internal and external human capital reporting. Provides the metrics framework (competency coverage, leadership pipeline, succession depth) that a mature 7.2 system reports.
• ISO 22300:2021, Security and resilience, Vocabulary. The normative source for definitions of competence, qualification, training, awareness, role, prioritised activity, disruption and recovery. A fourth edition (ISO/DIS 22300) is under development (enquiry stage) and will replace the 2021 edition when published; not yet published, re-confirm the year before quoting.
• ISO/TS 22318:2021, Supply chain continuity. Relevant to the Supplier Competence Map for organisations with material ICT or manufacturing supplier dependencies.
• ISO/IEC 27006:2015 / Amd 1:2020 / Amd 2:2024, requirements for bodies providing audit and certification of information security management systems. Useful when scoping the competence expected of auditors of the BCMS (the principle is mirrored in ISO/IEC 17021-1:2015 for management-system auditors generally).

Recognised professional certifications (citable, mapped TO)

Professional certifications are one evidentially clean route to demonstrating competence under Duty 1. They are not mandated by the clause, but they are widely recognised by Indian regulators and global frameworks. The most relevant for an Indian growing-company BCMS:

• BCI certifications and grades, the Business Continuity Institute offers the Certificate of the BCI (CBCI) foundation certification (with examination), with member grades, AMBCI (Associate Member), MBCI (Member), FBCI (Fellow), recognising experience and contribution. Widely recognised in Commonwealth and Indian BFSI contexts.
• DRI International certifications, the Disaster Recovery Institute International offers a tier: ABCP (Associate Business Continuity Professional), CFCP (Certified Functional Continuity Professional), CBCP (Certified Business Continuity Professional), CBCV (Certified Business Continuity Vendor), and MBCP (Master Business Continuity Professional). Widely recognised in the US, India BFSI and IT-ITeS.
• ISACA certifications, CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), CGEIT (Certified in the Governance of Enterprise IT). Especially relevant for IS-audit and risk-management competence under RBI MD IT Governance.
• ISC2 certifications, CISSP (Certified Information Systems Security Professional), CCSP (Certified Cloud Security Professional), HCISPP (HealthCare Information Security and Privacy Practitioner). For information-security leadership competence.
• EC-Council, CEH (Certified Ethical Hacker), CHFI (Computer Hacking Forensic Investigator). For penetration-testing and forensics competence (relevant to CERT-In Direction compliance).
• NCSIH, National Certification in Supreme Court of India Hospitals (NABH-aligned clinical-continuity credential; relevant to healthcare BCMS).
• NCFM / NISM, NSE Certification in Financial Markets / NISM Series certifications (capital-markets competence; relevant to SEBI-regulated BCMS for brokers, AMCs, MIIs).
• IRDAI-mandated insurance certifications, for insurance intermediary and insurer-employee roles.
• BCS / IIBA / ITIL 4 / PRINCE2 / PMP / TOGAF, for adjacent competence (business analysis, IT service management, project management) that bears on BCM-role execution.
• Sector-specific Indian regulator examinations, e.g., SEBI-mandated certifications for compliance officers (NISM Series XI-B, XV); RBI-mandated certifications for banks' internal ombudsman and IS auditors; IRDAI-mandated actuarial and underwriting certifications.

These certifications are routes to evidence of competence; they are not the competence itself. An auditor will ask: "Does the role require this certification? When was it last renewed? Is it current? Is it mapped to the actual work?" A lapsed or irrelevant certification is weaker evidence than a current exercise-evaluator rating of competence in role.

What auditors actually check

Certification auditors (BSI, DNV, SGS, TÜV, Bureau Veritas, NQA, Intertek, plus Indian certification bodies such as TQCS, DNV India and BSI India) test Clause 7.2 by triangulating three things:

• The competence documentation set, Competence Management Policy and Procedure, BCM Role Taxonomy, Competence Matrix, TNA, TDP, Effectiveness Evaluation Design, Periodic Re-validation Schedule, Key-Person Risk Register, Supplier Competence Map, and the per-role-holder Competence Evidence Record.
• Traceability to the work, does each BCM role in the BC plans (Clause 8.4) map to a role in the BCM Role Taxonomy? Does the role's competence profile reflect the actual decisions the role-holder must make in an exercise or a real event? Does the Evidence Record contain dated, sign-off-bearing artefacts rather than job titles?
• Traceability from the events, exercise reports (Clause 8.5), post-incident reviews (Clause 8.6), internal-audit findings (Clause 9.2), corrective-action records (Clause 10.1) and management-review minutes (Clause 9.3) should each show competence being measured, gaps being identified, actions being taken, and effectiveness being evaluated. A BCMS where the exercise report says "the CMT struggled to make a delegation decision" but the TDP contains no action to fix it is non-conformant.

Common observations you should be ready for: (a) "your Competence Matrix lists roles but no per-role-holder assessment" (an L2 finding); (b) "your BCM Manager has no formal BCM training in the last 36 months and no BCI/DRI certification" (an L1 non-conformity in BFSI/regulator-adjacent contexts); (c) "your DR engineer is a single person with no cross-trained alternate and the supplier cannot evidence competence of the DRS-staff who would actually invoke failover" (a sectoral non-conformity under RBI MD IT Governance eff. 1 April 2024 and SEBI MII BCP-DR 22 March 2021); (d) "your training records are attendance-only; you have not measured whether the training transferred into capability" (an L2 finding); (e) "your supplier-competence map does not include the cloud provider's staff who would actually invoke the DR runbook" (a non-conformity under RBI MD Outsourcing of IT Services 10 April 2023).

Why This Control Matters

The business case

Every other clause in ISO 22301 depends on human performance. The BIA (Clause 8.2) is only as good as the analyst who runs it. The strategy (Clause 8.3) is only as good as the strategist's understanding of the firm's dependencies. The plans (Clause 8.4) are only worth the paper they are written on if the people who must execute them can do so under stress. The exercises (Clause 8.5) are only as informative as the controllers and evaluators who design and assess them. The post-incident reviews (Clause 8.6) only generate corrective action if the reviewers know what good looks like. Internal audit (Clause 9.2) only finds what the auditor is competent to look for. Management review (Clause 9.3) only steers the BCMS if the reviewers understand the data in front of them. In every case, the value created by the rest of the BCMS is mediated by the competence of the people doing the work.

The competence clause is also the translation layer between the documented plan and the operational reality. When the COO asks "would our BCM team actually handle a 4-hour payment outage?", the answer cannot be derived from the BC plan document, it can only be derived from evidence of how the team performed under exercise conditions that approximated a 4-hour payment outage. That evidence is competence evidence. Without it, the COO's question is rhetorical; with it, the question becomes a measurable management decision.

There is also a direct financial case for competence management. Three categories of cost are reduced by a working 7.2 system: (i) incident-response cost, competent responders resolve incidents faster (industry datasets consistently show that the duration and severity of disruptions is dominated by first-responder capability, not by the technical severity of the trigger); (ii) exercise cost, competent exercise designers and controllers extract more learning per rupee spent (a poorly designed exercise consumes the same budget as a well-designed one but produces noise rather than signal); (iii) regulatory cost, competent BCM and IS-audit staff keep the organisation on the right side of the RBI, SEBI, IRDAI and CERT-In expectations, avoiding the financial and reputational hit of a regulator-driven remediation.

The regulatory case (the part competitors omit)

In India, BCM competence is no longer just an ISO artefact; it is a regulatory deliverable. Five recent instruments make it so:

• RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (issued 7 November 2023, effective 1 April 2024). Applies to Scheduled Commercial Banks (excluding Payments Banks, LABs, RRBs), NBFCs with asset base ≥ ₹500 crore, All-India Financial Institutions, and Credit Information Companies. The IT governance chapter expects the board and senior management to have the IT competence to discharge their oversight duties; the IT Service Continuity chapter expects qualified personnel staffing the BCP/DR functions; the IS-audit chapter expects competent IS auditors (whether internal or external). The MD's expectations are the regulatory expression of Clause 7.2 for the BFSI sector.
• RBI Cyber Security Framework in Banks (2 June 2016). Mandates a board-approved cyber-security policy and expects board-level cyber literacy; expects a 24x7 SOC with adequately trained manpower; expects the bank's Fraud Monitoring (FM) function to be staffed by competent personnel; expects incident-response staff to be capable of executing the Cyber Crisis Management Plan.
• RBI Master Direction on Outsourcing of IT Services (10 April 2023). Requires the Regulated Entity to ensure the outsourcer's staff are competent to deliver the continuity-relevant services; the RE cannot outsource the competence obligation along with the service.
• SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024, with phased 2025 deadlines (some reset by the March 2025 extension circular). Grades Regulated Entities into five categories, with manpower expectations scaling by category, including the SOC size, the CISO qualification, and the period training cadence. The CSCRC's six operational functions (Identify, Protect, Detect, Respond, Recover, Learn) each carry implied competence requirements.
• SEBI BCP/DR Guidelines for Market Infrastructure Institutions, circular SEBI/HO/MRD1/DTCS/CIR/P/2021/33, 22 March 2021, with modifications through 12 September 2024. Requires key-person risk management (alternates and cross-training for every BCM-critical role), and treats drill participation as competence evidence, staff who do not participate in drills cannot evidence the competence the drills are designed to build.
• IRDAI Information and Cyber Security Guidelines, 2023 (24 April 2023). Requires a board-approved training programme, a CISO with defined qualifications, DR-drill competence (staff who can execute the DR runbook under stress), ICT-outsourcing oversight staffing, and annual compliance reporting on the competence portfolio.
• CERT-In Directions No. 20(3)/2022-CERT-In, 28 April 2022. Empanelled "Point of Contact" must be competent to discharge the six obligations, most consequentially, the 6-hour incident reporting clock. A PoC who cannot recognise a reportable incident, or who cannot reach the right internal decision-maker within 30 minutes, has effectively breached the Direction. CERT-In continuity also requires forensics and incident-response capability (in-house or contracted) and a competent PoC for collateral engagements.
• DPDP Act 2023 (Act 22 of 2023). Section 8(5) imposes a statutory duty on Data Fiduciaries to protect the availability of personal data. The Data Protection Board will, in the event of an availability breach, ask whether the Data Fiduciary had staff competent to operate the safeguards the Act requires. Section 8(6) and the Schedule impose breach notification; the DPDP Rules 2025 (final notified November 2025) prescribe the 72-hour notification form. Schedule penalties reach ₹250 crore for failure to take adequate security safeguards and ₹200 crore for failure to notify a breach, both of which turn, in practice, on whether competent staff were in role.
• Companies Act 2013 §134(3)(n) requires the Board's Report to disclose risk-management policy including risks that may threaten the existence of the company; this implies the board is competent to oversee the risk-management system. §177 and SEBI LODR Regulation 21 require a Risk Management Committee for listed companies whose members must collectively have the competence to cover cyber, operational and continuity risk.
• NDMA Disaster Management Act 2005 and the NDMA Chemical Disaster Guidelines 2007 impose competence expectations on industrial operators, trained emergency-response personnel, mutual-aid partner capability, and integration of on-site and off-site emergency plans.

The board-level hook is critical: the regulator will not accept "we did not have a competent BCM Manager" as a defence. The board's risk-oversight duty (Companies Act §134(3)(n); RBI MD IT Governance board-IT competence expectation) means the board itself must have the competence to ask the right BCM questions, and to verify that the BCM Manager and team are competent to execute. This is why the most advanced Indian boards now run an annual BCM-awareness session and document it in the board minutes.

Indian Context (why this hits harder here)

Three structural features of the Indian growing-company segment make the 7.2 discipline disproportionately important, and disproportionately difficult:

Skills shortage. India produces a large number of engineers and management graduates each year, but the supply of qualified BCM professionals is structurally thin. The BCI and DRI pipelines produce a few thousand certificants a year across India; for the BFSI sector alone, RBI MD IT Governance (eff. 1 April 2024) creates demand for many more CISOs, BCM Managers, IS auditors and SOC leads than the supply can absorb. The result is a market where the resume may be polished but the capability may be uneven, making the organisation's own assessment of competence more consequential, not less. A working 7.2 system is the only credible response to a thin external market.

Attrition. Indian IT/BFSI sectors see attrition in the high-teens to mid-twenties percent annually at growing companies. A BCM team that was competent at the start of the year may be materially less competent by year-end purely through attrition. The 7.2 system must therefore be attrition-resilient: every BCM-critical role must have a named alternate, the alternate must be cross-trained to a documented level, the onboarding plan for a replacement must be ready, and the Competence Evidence Record must be controlled such that it survives the departure of the role-holder (institutional memory, not personal memory).

Family-run and promoter-led SMEs. A large fraction of Indian growing companies are promoter- or family-led, where the BCM role is held by a trusted generalist (often the COO or the IT Manager) with no formal BCM training. This is not a non-conformity by itself, but it becomes one when the BCMS policy commits to a competent BCM team and the Evidence Record is empty. The honest response is to either (i) train the generalist to a defensible level (BCI CBCI is the floor; DRI ABCP is an equivalent floor), (ii) appoint a formally qualified deputy, or (iii) engage a fractional/retained BCM adviser under a documented competence framework. The dishonest response, leaving the gap undocumented, is the single most common cause of Stage 1 major non-conformities on 7.2 in the Indian promoter-led segment.

Cost and access. Quality BCM training is expensive in absolute terms (a BCI CBCI cohort-based programme is in the range of ₹65,000 to ₹1,10,000 plus GST per participant in India in 2025–2026; a five-day DRI CBCP preparation course is comparable; CISSP preparation plus examination is in the range of ₹80,000 to ₹1,80,000 depending on delivery format). For a growing company, that is a real number per role-holder. A 7.2 system that prioritises, putting the spend where the BCMS-criticality is highest, and sequencing certification across the BCM team rather than front-loading, is the practical answer. Cost figures are category-level mid-market India ranges observed in 2025–2026; verify against current pricing before procurement.

Cross-training is non-negotiable. In a Western enterprise, the BCM team may be 8 to 15 people; in an Indian growing company, it is often 1 to 3 people plus a rota of coordinators. Single-points-of-failure are the default, not the exception. A 7.2 system that does not actively cross-train alternates is, in the Indian context, a system that is one resignation away from non-conformity. The Akasa Air pilot-exodus event of 2023, where 43 pilots resigned in a single month, ~600–800 flights were cancelled, and losses ran at ~₹3 crore per day at peak, is the aviation-industry analogue of what an unmitigated key-person risk in a BCM team looks like. The lesson is transferable.

The cost of getting 7.2 wrong

The cost of a 7.2 failure is rarely a clean "audit non-conformity" event; it is usually a disruption-exacerbating event, the disruption happens, the plans are activated, the people cannot execute, the recovery takes longer than the BIA-derived RTO, and the regulator opens an inquiry. Three Indian illustrative patterns make the cost concrete:

• The "single BCM Manager" failure, the only competent BCM professional in the firm resigns (or is on leave during the disruption); the BC plans are activated by someone who has never read them end-to-end; the recovery RTO is missed; the regulator asks for the Competence Evidence Record and finds the departed BCM Manager's file is the only evidence of competence for the entire programme.
• The "trained-but-never-exercised" failure, the BCM team has BCI or DRI certifications but has never run a simulation under stress; when the real event happens, the team discovers that classroom competence and crisis-room competence are different things. The exercise history (Clause 8.5) is the missing evidence.
• The "outsourced-and-unverified" failure, the cloud provider is contractually committed to a 4-hour RTO, but the provider's staff who would actually invoke the runbook have never been evidenced as competent to do so; when the event happens, the provider invokes the wrong runbook or invokes it late; the RE's regulator treats the gap as the RE's non-conformity, not the provider's (per RBI MD Outsourcing of IT Services).

Each of these is a Clause 7.2 failure mode dressed up as something else, an operational failure, a supplier failure, a governance failure. The honest root cause in each is that the organisation could not demonstrate the competence of the people who executed the BCMS on the day it mattered.

Scope and Applicability

By organisation size

By industry

• BFSI (banks, NBFCs, insurers, MIIs, PSOs). The most regulated sector for 7.2. The RBI MD IT Governance, SEBI CSCRF, SEBI MII BCP-DR and IRDAI Information and Cyber Security Guidelines all impose specific competence expectations on boards, senior management, CISOs, BCM Managers, SOC leads, IS auditors and DR teams. Sector-specific certifications matter: CISA/CISM/CRISC for IS-audit and risk; CISSP for information-security leadership; NISM Series XI-B for compliance officers; NCFM/NISM for capital-markets staff; BCI/DRI for BCM leadership. The board-IT-competence expectation (RBI MD) is sector-defining: a BFSI board with no member competent to challenge the CIO on IT risk is a non-conformity.
• Healthcare (hospitals, pharma manufacturers, diagnostics, health-tech). Patient-safety competence dominates. NCSIH and clinical-continuity credentials for clinical leaders; NABH-aligned training for hospital BCMS; GxP and pharmacovigilance competence for pharma manufacturers. The AIIMS Delhi ransomware of 23 November 2022 (peer-reviewed illustrative scenario) is the canonical example of a clinical-continuity failure compounded by competence gaps in offline-mode operations and incident response.
• IT-ITeS and SaaS. Customer-contractual competence dominates. The firm's BCM competence is itself a product feature (customer audits, due-diligence questionnaires, SOC 2 readiness). The Cognizant Maze ransomware of 18–20 April 2020 (SEC-filed 10-Q/K; Q2 2020 impact of US$50–70 million) is the canonical example of a globally-federated IT-services firm discovering that its BCM competence was unevenly distributed across delivery centres.
• Manufacturing (chemical, automotive, electronics, pharma manufacturing). Industrial-continuity competence dominates, process-safety, OT/ICS resilience, supplier-chain continuity, mutual-aid. The LG Polymers styrene gas leak of 7 May 2020 in Visakhapatnam (NGT interim penalty ₹50 crore; LG Chem relief package ₹730 crore) is the canonical example of an industrial-continuity failure compounded by competence gaps in emergency-response and process-safety. The Maruti Suzuki Manesar violence and fire of 18 July 2012 (~₹1,400 crore lockout loss) is the canonical example of a workplace-violence continuity failure.
• Government and public sector. Constitutional-continuity competence dominates, DM Act 2005 obligations, NDMA guidelines, mutual-aid with state and district authorities, critical-information-infrastructure protection (IT Act §70A NCIIPC). Public-sector BCM competence is also a procurement obligation, MeitY cloud empanelment requires continuity disclosures from cloud providers serving the Government of India.

What is in scope for 7.2

A person is in scope of Clause 7.2 when their work affects the BCMS. The practical test is the BCM Role Taxonomy: if the role appears in the taxonomy, the role-holder is in scope. The taxonomy typically includes:

1. BCM programme roles, BCM Manager, BCM Coordinator(s), BCM Steering Committee Chair and members, BCM internal-audit lead.
2. Crisis response roles, CMT Chair, CMT members (typically CEO, COO, CFO, CIO, CISO, CHRO, Head of Legal, Head of Communications, Head of Operations), Crisis Communications Lead, alternates for each.
3. IT DR roles, DR Manager, DR engineers, backup operators, network team, cloud-operations team, application-recovery owners.
4. Information-security roles, CISO, SOC Manager, SOC analysts, incident-response lead, forensics lead, IS-audit lead.
5. BCM-adjacent functional roles, HR Business Partners (for workforce continuity), Head of Facilities (for site continuity), Head of Procurement (for supplier continuity), Head of Legal (for regulator and contractual continuity), Head of Communications (for crisis comms), Company Secretary (for board reporting).
6. Executive sponsors, CEO/MD, board members of the Risk Management Committee or Audit Committee with BCM oversight.
7. Supplier roles, staff of suppliers who deliver continuity-relevant services (cloud DR, managed SOC, work-area recovery, mutual-aid partners, retained advisers).

A role is in scope of 7.2 in respect of the BCMS work it does, not in respect of the role-holder's whole job. A Head of Procurement who is excellent at procurement but has never been briefed on supplier-continuity assessment is in scope of 7.2 for the supplier-continuity dimension; the rest of the procurement role is out of scope. This scoping discipline is what makes 7.2 tractable for a growing company, the BCM-critical slice is much smaller than the full job.

What is out of scope

• Workforce BCM awareness (everyone knows the policy and the evacuation alarm), Clause 7.3.
• Resourcing the BCM roles (budget, headcount, tooling), Clause 7.1.
• Assigning the BCM roles (who does what), Clause 5.3.
• The competence of the auditors of the BCMS (the certification body's auditors), governed by ISO/IEC 17021-1:2015 and the certification body's own accreditation.
• The competence of suppliers in respect of their own management systems, only the competence delivered to the organisation is in scope.

Key Definitions and Terminology

These definitions are paraphrased to fit the BCMS context; the normative source is ISO 22300:2021 (verify whether a 2025 edition has published before quoting year).

• Competence. The demonstrated ability to apply the knowledge, skills and behaviour required to do BCM work to the standard the role requires. Competence is demonstrated, not asserted; it is role-bound, not generic; and it is current, not historic. The most common 7.2 mistake is to treat "qualifications" or "experience" as a proxy for competence, they are evidence of potential competence, not evidence of competence itself.
• Qualification. A formal recognition (degree, diploma, certificate) issued by a recognised body attesting that the holder has met a defined standard. A BCI CBCI certificate is a qualification; an engineering degree is a qualification; a CISSP is a qualification. Qualifications are evidence of competence but not competence itself.
• Education. The structured acquisition of knowledge through a curriculum, degrees, diplomas, university programmes. Education is one of the three routes the clause identifies for acquiring competence. In the BCM context, education typically covers the underlying disciplines (computer science, engineering, business administration, risk management, public administration for government BCM) on which BCM-specific training is layered.
• Training. The structured transfer of skill through instruction, instructor-led, e-learning, simulation, drill, on-the-job coaching. Training is the second of the three routes. Training is effective when it produces a measurable change in on-the-job capability; it is ineffective when it produces only a certificate of attendance.
• Experience. Time-on-task in role, with the depth and variety the role requires. Experience is the third of the three routes. Twenty years of doing the wrong thing is not competence; two years of doing the right thing under varied conditions may be. The maturity of experience is measured by the range of scenarios encountered and reflected on, not by the elapsed time alone.
• Certification (person). A formal attestation by a recognised body that an individual meets a defined competence standard, BCI CBCI, DRI CBCP, ISACA CISA, ISC2 CISSP, etc. Distinct from "certification (organisation)" under ISO 22301:2019.
• Awareness. Workforce-wide knowledge of the BCMS policy, individual BCM roles, and the consequences of not following BCMS requirements. Awareness is the subject of Clause 7.3 and is the baseline layer; competence (7.2) is the role-specific layer built on top.
• BCM Role Taxonomy. The structured list of every role whose work affects the BCMS, with role-to-BCMS-criticality mapping. The taxonomy is the spine of the 7.2 system; without it, competence cannot be determined, assessed, evidenced or re-validated in a tractable way.
• Competence Matrix. The role-by-dimension grid that records, per role-holder, the required and current rating on each competence dimension. The matrix is the operational artefact around which 7.2 is built; it is the auditor's primary window.
• Training Needs Analysis (TNA). The structured identification of the gap between required and current competence, aggregated across role-holders into prioritised actions. The TNA is the bridge between the assessment and the plan.
• Training and Development Plan (TDP). The dated, budgeted, owner-assigned action plan that closes the gaps the TNA identifies. The TDP is what the auditor means by "actions to acquire competence."
• Competence Evidence Record. The per-role-holder file of dated, sign-off-bearing artefacts that demonstrate the competence exists. Controlled under Clause 7.5.
• Effectiveness Evaluation. The structured measurement of whether a training intervention produced a measurable change in on-the-job capability. Without effectiveness evaluation, training is activity, not competence-building.
• Periodic Re-validation. The scheduled re-confirmation that a role-holder's competence remains current. Competence decays (skills not used; regulations change; technologies evolve); re-validation is the mechanism that catches the decay.
• Key-Person Risk. The risk that the loss of a single individual would degrade the BCMS. Every BCM-critical role should have an identified key-person risk treatment (cross-training, deputy, succession).
• Cross-Training. The deliberate development of competence in a second role-holder so that the role can be executed by more than one person. The principal treatment for key-person risk in growing companies.
• Behavioural Competence. The non-technical dimension, judgement under uncertainty, delegation, communication, composure in the crisis room, ethical reasoning. Often the difference between a role-holder who has the qualifications and a role-holder who can actually do the role in a real event.
• Documented Information of Competence. The aggregate of all Clause 7.5-controlled records that evidence competence, qualifications, attendance, assessments, sign-offs, exercise ratings, audit observations. The auditor will ask to see this aggregated per role-holder, not scattered across systems.
• Crisis Management Team (CMT). The cross-functional team that leads the organisation's response to a disruption. CMT competence is a distinct discipline from technical BCM competence, it is decision-making under uncertainty, not plan execution.
• MTPD / RTO / RPO / MBCO. Defined under ISO 22300:2021 and used in the BIA (Clause 8.2). Relevant to 7.2 because the competence required of a role-holder is partly determined by the RTO/RPO/MBCO the role must deliver against, a role that must deliver a 30-minute RTO requires a different competence profile from one that must deliver a 24-hour RTO.

The five-dimension competence model

A working 7.2 system assesses each role-holder against five dimensions:

1. Education, the formal qualifications that underpin the role (a BCM Manager's bachelor's degree in business or engineering; a CISO's master's in information security; a board member's accountancy or legal qualification).
2. Training, the BCM-relevant programmes completed and current (BCI CBCI, DRI CBCP, CISA, internal DR drills, NISM Series certifications).
3. Experience, time-on-task in role, with the depth and variety the role requires (years in BCM, years in the sector, range of disruptions encountered, range of exercises led).
4. Certification, the formal attestations of competence from recognised bodies (BCI grades AMBCI/MBCI/FBCI; DRI ABCP/CBCP/MBCP; ISACA CISA/CISM/CRISC; ISC2 CISSP; sector-specific regulator-mandated certifications).
5. Behaviour, the on-the-job evidence of capability under stress (exercise-evaluator ratings; peer-feedback in post-incident reviews; observed performance in drill controllers' notes; mentor assessments).

The five dimensions are weighted by role. For a BCM Manager, all five carry weight. For a CISO, training and certification dominate (with experience as evidence). For a board member, behaviour (judgement in the crisis room) and education (sufficient literacy to challenge the CIO) carry the most weight. For a supplier-staff member, certification and training dominate because the organisation cannot observe behaviour directly.

The four-level rating scale

Each dimension is rated on a four-level scale per role-holder:

• Level 1, Awareness. The role-holder is aware of the dimension but cannot perform without close supervision. Typically a new starter or a role-holder in early training.
• Level 2, Application. The role-holder can perform under routine conditions with normal supervision. The baseline target for most BCM-relevant roles.
• Level 3, Proficiency. The role-holder can perform under non-routine conditions with minimal supervision, and can coach others. The target for BCM-critical roles.
• Level 4, Mastery. The role-holder can perform under stress conditions with no supervision, can design the work for others, and can evaluate others' performance. The target for the BCM Manager, CMT Chair, CISO, and other senior BCM roles.

The four levels are deliberately concrete: an auditor should be able to ask "what is the evidence that this role-holder is at Level 3 on the training dimension?" and get a specific answer ("they led the last DR drill, the controller's notes rate them Proficient on failover execution, and they have a current DRI CBCP certification").

Relationship to Other Clauses and Frameworks

Relationship to other ISO 22301:2019 clauses

Clause 7.2 is one of the most densely interconnected clauses in ISO 22301, almost every other clause either feeds it or feeds from it. The principal relationships:

• Clause 4.1 / 4.2 (Context, interested parties). The context shapes the competence footprint, a BFSI firm needs different BCM competence from a manufacturer; a firm with significant EU exposure needs DORA-aware competence. Interested-party expectations (regulator, customer, insurer, certifier) carry specific competence implications.
• Clause 4.3 (Scope). Determines which roles are BCM-relevant and therefore in scope of 7.2.
• Clause 5.1 (Leadership). Top management ensures the people doing BCM work are competent, non-delegable for the resourcing decision; the board's own BCM competence is part of the package.
• Clause 5.2 (Policy). The policy commits to competence; 7.2 operationalises the commitment.
• Clause 5.3 (Roles, responsibilities, authorities). 5.3 assigns the roles; 7.2 makes sure the people in them are competent. The two clauses form a single workflow.
• Clause 6.1 (Risks and opportunities). Risk treatments may require new competence, a decision to take on DORA-regulated EU business creates a competence requirement that flows through 6.1 into 7.2.
• Clause 6.2 (Objectives). BCM objectives imply competence targets; an RTO objective of 2 hours implies a DR-engineer competence profile that can deliver a 2-hour failover. An objective without competent people to deliver it is a wish.
• Clause 6.3 (Changes to the BCMS). BCMS changes have competence implications, new tooling requires new training; new sites require new local Coordinators; new suppliers require new supplier-competence verification.
• Clause 7.1 (Resources). 7.1 funds the people; 7.2 makes them capable. The two clauses form a single workflow with 7.1 as the supply side and 7.2 as the capability side.
• Clause 7.3 (Awareness). 7.3 is the workforce-wide baseline; 7.2 is the role-specific regime built on top. The boundary is the BCM Role Taxonomy: in-taxonomy roles are 7.2; everyone else is 7.3.
• Clause 7.4 (Communication). Communication roles must be competent, the Crisis Communications Lead is a high-stakes role where behavioural competence (judgement, composure) is decisive.
• Clause 7.5 (Documented Information). The Competence Evidence Record is controlled under 7.5; without 7.5 discipline, 7.2 evidence is uncontrolled and the system is non-conformant.
• Clause 8.1 (Operational planning and control). Staff executing operations must be competent, 8.1 is where 7.2 shows up operationally.
• Clause 8.2 (BIA). BIA analysts must be competent; the quality of the BIA is bounded by the analyst's competence.
• Clause 8.3 (Strategy). Strategists must be competent; the quality of the strategy is bounded by the strategist's competence.
• Clause 8.4 (Plans and procedures). Plan-execution roles must be competent, this is where 7.2 is most consequential. A plan that no one can execute is non-conformant.
• Clause 8.5 (Exercise programme). Exercises are the principal mechanism for evidencing and building competence. The exercise programme and the competence programme are deeply intertwined, exercise participation is competence evidence; exercise performance is competence assessment.
• Clause 8.6 (Evaluation of documentation and capabilities). The evaluation should consider whether the people are still competent to execute the documentation, capability is human, not paper.
• Clause 9.1 (Monitoring, measurement, analysis, evaluation). Competence KPIs (matrix-coverage %, gap-closure rate, effectiveness %, re-validation currency) feed the monitoring regime.
• Clause 9.2 (Internal audit). Internal audit tests the competence discipline, sampling role-holders and walking the evidence end-to-end.
• Clause 9.3 (Management review). The competence portfolio is a standard input to the management review; top management needs to see the matrix-coverage, the gaps, the actions, and the trends.
• Clause 10.1 (Nonconformity and corrective action). Corrective actions are often competence events, post-incident re-training, post-exercise coaching, post-audit re-attestation.
• Clause 10.2 (Continual improvement). Continual improvement of competence, advancing role-holders from Level 2 to Level 3 to Level 4, is the substance of 7.2 maturity.

Relationship to other ISO management-system standards

• ISO/IEC 27001:2022 Clause 7.2, the ISMS analogue. Identical Harmonized Structure. An integrated ISMS+BCMS organisation runs a single competence-management workflow that satisfies both clauses. The ISMS's Annex A control A.5.10 (Information security awareness, education and training) is the ISMS-specific extension of 7.2 and maps to the BCMS awareness (7.3) and competence (7.2) pair. A.6.3 (Information security awareness, education and training) in the old ISO 27001:2013 numbering corresponds to the same control; in the 2022 restructure it migrated to A.5.10. The migration is a common source of audit confusion, confirm the current Annex A reference before citing.
• ISO 9001:2015 Clause 7.2, the QMS analogue. Useful where the organisation has an integrated QMS+BCMS (common in manufacturing and healthcare).
• ISO 14001:2015 Clause 7.2, the EMS analogue. Relevant for organisations with integrated environmental+BCM systems (chemical, manufacturing).
• ISO 45001:2018 Clause 7.2, the OHSMS analogue. Relevant where BCM and occupational health and safety are jointly managed (work-area recovery, employee safety during disruptions).
• ISO/IEC 20000-1:2018 Clause 7.2, the ITSM analogue. Relevant for IT-ITeS firms with integrated ITSM+BCM systems.
• ISO 30414:2018, human capital reporting. Provides the metrics framework a mature 7.2 system uses to report competence coverage and pipeline to the board.

Relationship to non-ISO BCM frameworks

• NIST SP 800-34 Rev 1 (May 2010), step 6, Plan testing, training and exercises. The US federal contingency-planning reference. Step 6 of the seven-step contingency planning process is the closest non-ISO analogue to ISO 22301 Clause 7.2 + 7.3 + 8.5 combined. Useful when mapping for US customers or US-Indian firms.
• NIST SP 800-181 Rev 1, Workforce Framework for Cybersecurity (NICE Framework). The canonical cyber-workforce taxonomy: Work Roles, Tasks, Knowledge, Skills, Abilities. Useful when designing the BCM Role Taxonomy for the IT DR / IS / SOC slice.
• NIST CSF 2.0 (February 2024), Govern function (GV.OC-04, GV.RR-02, GV.SC-04), the new (in 2.0) Govern function carries explicit expectations about organisational roles, cybersecurity awareness and education, and oversight accountability. Maps to ISO 22301 Clause 5.1, 5.3 and 7.2 jointly.
• FFIEC BCM Booklet (November 2019), governance and accountability section explicitly addresses the competence expectations on boards and senior management of US financial institutions. Maps to ISO 22301 Clause 5.1 + 7.2.
• DORA, Regulation (EU) 2022/2554 (applies 17 January 2025), Article 5(4) requires the management body to oversee the ICT-risk framework and to follow specific training to develop the necessary expertise; Article 13 requires learning and evolving from incidents; Article 19 requires incident reporting by competent staff. DORA's training obligations are the EU financial-sector analogue of ISO 22301 Clause 7.2, with explicit management-body training.
• APRA CPS 230 (effective 1 July 2025), paragraphs 16, 41, 47, operational-risk management standard for Australian APRA-regulated entities. Includes competency expectations on the management body and senior management; CPS 230 para 41 explicitly requires appropriate skills and experience in operational-risk management staff.
• MAS TRM Guidelines (Singapore), Technology Risk Management guidelines for MAS-regulated financial institutions, with explicit competence expectations on technology and operations staff, including board and senior-management technology-awareness expectations.
• HKMA TM-G-2 and SA-2 (Hong Kong), technology-risk management and supervisory expectations for HKMA-regulated institutions, including competence of technology and resilience staff.

The cross-framework mapping is summarised in Section 16.

Detailed Implementation Guidance, The Eight-Stage Competence Management Workflow

Figure · Process

What Clause 7.2 asks you to do

This section is the practitioner core of the guide. The eight-stage workflow is designed to satisfy Clause 7.2 end-to-end, from identifying the roles to continually improving the competence system, and to produce, at each stage, the evidence an auditor will look for. The workflow is a cycle: stage 8 returns to stage 1, refreshed.

Stage 1, Identify the BCM-relevant roles (build the BCM Role Taxonomy)

Objective. Produce a structured, complete list of every role whose work affects the BCMS, with role-to-BCMS-criticality mapping.

Inputs. The BCMS scope (Clause 4.3), the BCMS Policy (Clause 5.2), the Roles, Responsibilities and Authorities register (Clause 5.3), the BC plans (Clause 8.4), the exercise scenarios (Clause 8.5), the supplier register, the organisational chart.

Method.

1. Walk each BC plan and extract every named role, incident commander, evacuation marshal, DR engineer, crisis comms lead, alternate for each.
2. Walk the CMT roster and add each role plus alternates.
3. Walk the BCM programme structure and add the BCM Manager, Coordinators, BCM Steering Committee members.
4. Walk the IT DR structure and add DR Manager, engineers, backup operators, network, cloud ops.
5. Walk the IS structure and add CISO, SOC lead, SOC analysts, IR lead, forensics, IS-audit lead.
6. Walk the BCM-adjacent functions (HR, Facilities, Procurement, Legal, Communications, Company Secretary) and add the BCM-relevant slice of each.
7. Walk the executive layer (CEO/MD, board Risk Management Committee members, Audit Committee members with BCM oversight).
8. Walk the supplier register and add the supplier roles that deliver continuity-relevant services (cloud DR engineers, managed SOC analysts, work-area-recovery staff, retained advisers, mutual-aid partners).
9. For each role, assign a BCM-criticality, Tier 1 (BCMS-critical; loss would degrade BCMS within hours), Tier 2 (BCM-relevant; loss would degrade BCMS within days), Tier 3 (BCM-supporting; loss would degrade BCMS within weeks).

Outputs. The BCM Role Taxonomy. A typical Indian growing company taxonomy has 25–70 BCM-relevant roles; an enterprise can have 100+.

Common mistake. Omitting supplier roles. The most frequent Stage 1 failure is a taxonomy that includes the supplier organisation but not the named individuals (or at least the named roles) at the supplier who would actually invoke the runbook, restore the system, or staff the recovery.

Stage 2, Determine the required competence per role (build the Competence Profile)

Objective. For each role in the taxonomy, document the required competence across the five dimensions.

Inputs. The role description (Clause 5.3), the BC plan the role-holder must execute (Clause 8.4), the RTO/RPO/MBCO the role must deliver against (Clause 8.2 BIA), the regulatory regime applicable to the role (RBI/SEBI/IRDAI/CERT-In as relevant), the relevant framework expectations (DORA, CPS 230, MAS TRM), the relevant professional certification landscape (BCI, DRI, ISACA, ISC2, sector-specific).

Method. For each role, fill out the Competence Profile template:

Outputs. A Competence Profile per role in the taxonomy. Together, the profiles form the requirement side of the competence equation.

Common mistake. Copy-pasting a generic profile across all roles. The value of the profile is in its specificity, a CMT Chair profile, a DR engineer profile, a BCM Coordinator profile, a board-member profile are all materially different.

Stage 3, Assess current competence per role-holder (populate the Competence Matrix)

Objective. For each role-holder, assess the current competence against the profile, and rate the gap.

Inputs. Each role-holder's CV; existing qualification certificates; training records (from LMS or HR file); prior exercise-evaluator ratings; prior performance reviews; the role-holder's self-assessment.

Method. For each role-holder × each dimension, assign a Level 1–4 current rating, and compute the gap (Required minus Current). A negative or zero gap is conformant; a positive gap is a development action.

The assessment is conducted by a competent assessor, typically the BCM Manager for BCM-critical roles, the line manager for BCM-adjacent roles, and the supplier-relationship owner for supplier roles. The role-holder's self-assessment is collected separately and triangulated; large discrepancies between self-assessment and assessor rating are themselves diagnostic.

Outputs. The Competence Matrix, a role-holder × dimension grid with required, current and gap columns. This is the auditor's primary window into 7.2; it must be complete, current and controlled under Clause 7.5.

Common mistake. Rating the role-holder against the role they used to hold rather than the role they currently hold. Internal mobility without re-assessment is a frequent cause of stale matrices.

Stage 4, Identify gaps and prioritise (build the Training Needs Analysis)

Objective. Aggregate the gaps across role-holders into prioritised actions.

Inputs. The Competence Matrix with gaps; the BCM-criticality (Tier 1/2/3) from the Role Taxonomy; the BCMS objectives (Clause 6.2); the regulatory calendar (RBI/SEBI/IRDAI/CERT-In changes); the planned exercise calendar (Clause 8.5); the supplier contract-renewal calendar.

Method. For each gap, prioritise on:

• Criticality of the role (Tier 1 first).
• Severity of the gap (Level 1 gap on a Level-3-required dimension is more severe than a Level 3 gap on a Level-4-required dimension).
• Time-to-close (a 5-day certification course can be scheduled in weeks; an MBCI application takes months; a successor-development plan takes years).
• Cost-to-close (₹65k for a CBCI cohort seat vs ₹2–5 lakh for a full leadership programme).
• Trigger urgency (an upcoming regulatory deadline or a planned exercise may compress the timeline).

For each gap, decide the action type: (a) train (close via training); (b) hire (close via recruitment); (c) contract (close via a supplier or retained adviser); (d) mentor/coach (close via on-the-job development); (e) reassign (move the role-holder to a role that fits their competence); (f) accept as risk (with documented top-management acceptance and a mitigation plan).

Outputs. The Training Needs Analysis, a prioritised list of actions with role-holder, gap, action type, owner, priority and indicative cost band. This is the substance of what the auditor calls "actions to acquire competence."

Common mistake. Treating every gap as a training problem. Some gaps are best closed by hiring, some by contracting, some by reassigning. A TNA where every action is "send on a course" usually indicates that the analysis stopped at training-as-activity rather than continuing to competence-as-outcome.

Stage 5, Acquire competence (execute the Training and Development Plan)

Objective. Close the gaps identified in the TNA, within the agreed timeline and budget.

Inputs. The TNA; the BCMS budget (Clause 7.1); the L&D calendar; the supplier-procurement plan; the HR onboarding/exit forecast.

Method. Convert the TNA into a dated, budgeted, owner-assigned Training and Development Plan. Execute across five channels:

1. External training programmes, BCI CBCI cohort (typically 3–5 days plus exam), DRI CBCP preparation (typically 4–5 days plus exam), CISSP preparation (typically 5 days plus self-study plus exam), sector-specific regulator programmes. Budget: ₹65,000–₹2,00,000 per seat per certification in India in 2025–2026 (category-level; verify before procurement).
2. Internal training programmes, induction for new BCM role-holders; refresher for the CMT; role-specific deep-dives (DR engineer, SOC analyst, BCM Coordinator). Delivered by the BCM Manager, retained adviser, or L&D staff. Budget: ₹3–10 lakh per year for a mid-market BCM programme.
3. Exercises and simulations, the highest-use channel for behavioural competence. A well-designed exercise (Clause 8.5) builds and evidences competence simultaneously. Budget: ₹5–25 lakh per major simulation in a growing firm.
4. Mentoring and coaching, paired role-holder/mentor relationships, particularly for succession-critical roles. Budget: ₹2–8 lakh per year for a small retained-adviser relationship.
5. Hiring and contracting, where the gap is structural (e.g., the firm has no BCM Manager at all), the answer is recruitment or a fractional/retained engagement. Budget: market-rate recruitment; ₹2–10 lakh per month for a fractional BCM Director.

Outputs. Executed TDP items with completion evidence (attendance, assessment, certificate, exercise rating, mentor sign-off).

Common mistake. Treating training as the only channel and ignoring the use of exercises. In a growing company, a well-designed exercise is typically 2–4x more cost-effective per unit of behaviour-change evidence than classroom training, and the evidence is exactly what the auditor wants.

Stage 6, Evaluate effectiveness (close the loop)

Objective. For each intervention, measure whether it produced a measurable change in on-the-job capability.

Inputs. The TDP; the pre-intervention competence rating; post-intervention exercise-evaluator ratings; audit findings; incident-response performance; line-manager observations; peer feedback.

Method. Apply a Kirkpatrick-style four-level evaluation per intervention:

• Level 1, Reaction. Did the role-holder find the training relevant and engaging? (Post-training survey; one-page reflection.)
• Level 2, Learning. Did the role-holder acquire the intended knowledge/skill? (End-of-programme assessment; certification examination; internal competence reassessment.)
• Level 3, Behaviour. Did the role-holder apply the learning on the job? (Line-manager observation at 90 days; exercise-evaluator rating at the next exercise; peer feedback.)
• Level 4, Results. Did the application produce the intended BCMS outcome? (Improved RTO achievement in exercises; fewer audit findings; faster incident-response times; improved regulator interactions.)

Levels 1 and 2 are cheap and necessary; Level 3 is the operational measure; Level 4 is the strategic measure. The auditor cares most about Level 3, did the training change behaviour?

Outputs. An effectiveness rating per intervention, feeding back into the TDP cycle and into the next TNA. The Effectiveness Evaluation Design document specifies, per intervention type, which levels will be measured, by whom, when, and to what standard.

Common mistake. Measuring only Level 1 (reaction). A training programme where every participant rated it 4.5/5 but no one changed behaviour is a non-conformity in disguise; it is competence-theatre.

Stage 7, Maintain Documented Information of competence (the Competence Evidence Record)

Objective. Per role-holder, maintain a complete, current, controlled evidence file that demonstrates the competence exists.

Inputs. All artefacts produced in Stages 1–6: CV, qualifications, certificates, attendance records, assessment results, exercise-evaluator ratings, mentor sign-offs, line-manager attestations, audit observations, peer-feedback summaries.

Method. Establish a Competence Evidence Record per role-holder under Clause 7.5 document control. The record includes:

• Identity, name, role, BCM-criticality tier, date into role, alternate (with their own evidence record cross-referenced).
• Profile, the Competence Profile for the role.
• Assessment, the current Competence Matrix entry (required, current, gap per dimension).
• Qualifications, degrees, certificates, with verification and expiry.
• Training history, every BCM-relevant training event attended, with date, provider, format, duration, assessment result.
• Exercise history, every exercise participated in, with role, scenario, controller's evaluation, evidence of behaviour change.
• On-the-job evidence, line-manager attestations, peer feedback, post-incident review participation notes.
• Re-validation history, the dates and results of periodic re-validations.
• Action log, current TDP actions assigned to the role-holder, with status and effectiveness rating.
• Sign-offs, the role-holder, the line manager, the BCM Manager.

Outputs. A controlled Competence Evidence Record per role-holder. The aggregate is the organisation's "competence portfolio."

Common mistake. Evidence scattered across HR files, BCM team files, supplier records and exercise reports with no aggregation. An auditor who has to spend two hours reconstructing one role-holder's evidence has already formed the view that 7.2 is non-conformant.

Stage 8, Review and continually improve

Objective. Feed the competence portfolio into the management review (Clause 9.3) and the continual-improvement cycle (Clause 10.2); refresh the system on trigger events.

Inputs. The competence portfolio (Stage 7); the KPI dashboard (Section 12); the management-review calendar; the trigger events.

Method.

1. Scheduled review, at every Clause 9.3 management review, present the competence portfolio: matrix-coverage %, gap-closure rate, effectiveness %, re-validation currency, key-person-risk status, supplier-competence status. Top management signs off on accepted risks and on the next cycle's TDP budget.
2. Trigger-based review, refresh the matrix and the TDP on: role-holder change (joiner, mover, leaver); organisational change (restructure, M&A, new business line, new site); post-incident (Clause 8.6 / 10.1); post-exercise (Clause 8.5); regulatory change (RBI/SEBI/IRDAI/CERT-In updates); supplier change (contract renewal, supplier personnel change); certification expiry (BCI/DRI/CISA/CISSP renewals).
3. Continual improvement, set maturity-advancement targets (Section 22); benchmark against sector peers; invest in advanced certifications (MBCI, MBCP, CISSP-ISSMP, CRISC) for senior BCM leaders; invest in LMS and HRIS integration; invest in behavioural assessment tooling.

Outputs. Updated Role Taxonomy, Competence Profiles, Competence Matrix, TNA, TDP, Evidence Records; approved competence-portfolio decisions; matured 7.2 system.

Common mistake. Treating the matrix as an annual exercise rather than a living document. A matrix reviewed only once a year is stale for 364 days; a matrix reviewed on every trigger is current.

The BCM Role Taxonomy, illustrative role-by-role profiles

The following profiles are illustrative, your context determines the final form. Use them as a starting point for your own Competence Profiles.

BCM Manager (Tier 1).

• Education: bachelor's degree in business, engineering, computer science, or public administration; master's preferred.
• Training: BCI CBCI (current) or DRI CBCP (current); annual BCM refresher; DORA/CSCRF briefing when regulatory change occurs; drill-controller training.
• Experience: 5+ years in BCM or operational resilience; 2+ years leading exercises; range of disruptions encountered (cyber, natural, supplier, utility).
• Certification: BCI CBCI minimum; AMBCI/MBCI preferred. Or DRI ABCP/CBCP minimum; MBCP preferred. ISACA CRISC preferred for BFSI.
• Behaviour: Level 3 (Proficient) on judgement, delegation, composure, cross-functional communication, board engagement.

BCM Coordinator (Tier 2).

• Education: bachelor's degree in any discipline.
• Training: BCI CBCI (current) or equivalent internal BCM Coordinator certification; refresher annually; BU-specific BCM procedures.
• Experience: 2+ years in the BU; familiarity with the BU's processes, suppliers, and customer obligations.
• Certification: BCI CBCI preferred; internal certification acceptable at lower maturity.
• Behaviour: Level 2 (Application) on coordination, communication, documentation; Level 3 on executing the BU's BC plan.

CMT Chair (Tier 1).

• Education: senior executive qualification (MBA, CA, LLB, or equivalent).
• Training: CMT-specific training (crisis decision-making, delegation under uncertainty, regulator engagement); refresher annually; participation in at least one major simulation per year.
• Experience: 10+ years in senior leadership; prior CMT participation.
• Certification: not typically required; BCI/DRI optional.
• Behaviour: Level 4 (Mastery) on judgement, composure, communication, delegation. This is the dimension that matters most for this role.

DR Manager / DR Engineer (Tier 1 / Tier 2).

• Education: bachelor's in computer science, engineering, or related.
• Training: vendor-specific DR training (cloud, virtualisation, backup); DR drill controller training; sector-specific DRS training.
• Experience: 3+ years in IT operations; 1+ year specifically in DR.
• Certification: vendor-specific (e.g., cloud architect certifications); ISO 22301 awareness; BCI/DRI optional.
• Behaviour: Level 3 on failover execution, post-restoration validation, communication with the BCM team.

CISO (Tier 1).

• Education: bachelor's in computer science, engineering, or related; master's preferred.
• Training: CISSP preparation; CISM preparation; sector-specific regulator programmes (RBI/SEBI/IRDAI CISO roundtables); CSCRF/DORA briefings.
• Experience: 8+ years in information security; 3+ years leading a SOC or IS function.
• Certification: CISSP strongly preferred; CISM/CRISC complementary. CISO for a BFSI should have at least one of CISSP, CISM, or equivalent.
• Behaviour: Level 4 on judgement, board engagement, regulator engagement.

Crisis Communications Lead (Tier 1).

• Education: bachelor's in communications, journalism, or related.
• Training: crisis communications training; media training; spokesperson training; participation in CMT simulations.
• Experience: 5+ years in communications; 1+ year in crisis-specific role.
• Certification: not typically required; sector-specific (e.g., IRDAI-mandated for insurers) where applicable.
• Behaviour: Level 4 on composure, judgement, message discipline, stakeholder empathy. Behaviour is decisive for this role.

Board Risk Management Committee member (Tier 1, governance).

• Education: senior professional qualification (CA, MBA, LLB, or equivalent).
• Training: annual BCM briefing; cyber-literacy briefing; regulator-expectations briefing (RBI/SEBI as applicable).
• Experience: prior board or senior-executive experience.
• Certification: not typically required; BCI/CISA awareness programmes beneficial.
• Behaviour: Level 3 on challenge-asking, risk-appetite articulation, oversight discipline.

Supplier-side DR Engineer (Tier 1, supplier).

• Education: bachelor's in computer science or related.
• Training: supplier-internal DR training; cloud-vendor certifications; client-specific DR runbook training.
• Experience: 2+ years in supplier's DR function.
• Certification: vendor-specific; BCI/DRI optional.
• Behaviour: not directly observable by the client; inferred from supplier evidence (exercise participation, runbook currency, audit results).

Worked example, a Mumbai mid-market insurer

To make the workflow concrete: a Mumbai-based mid-market health insurer (1,400 staff; regulated by IRDAI; 8 critical IT systems; BIA-derived RTO of 4 hours for claims processing, 1 hour for cashless-authorisation). The BCM Manager runs the eight-stage workflow:

• Stage 1 (Role Taxonomy): identifies 42 BCM-relevant roles, BCM Manager + 2 Coordinators; CMT (8 + alternates); DR team (4); SOC (6); IR/forensics (2 contracted); BCM-adjacent (HR 2, Facilities 2, Procurement 2, Legal 1, Communications 2, Company Secretary 1); board Risk Committee (4); supplier roles (cloud DR 3, managed SOC 4, work-area recovery 1).
• Stage 2 (Profiles): writes 42 Competence Profiles. The CMT Chair profile is heavy on behaviour; the DR engineer profile is heavy on certification; the board-member profile is heavy on briefing currency.
• Stage 3 (Matrix): assesses all 42 role-holders. Discovers 18 gaps, most consequentially, the BCM Manager has a lapsed BCI CBCI (last renewed 4 years ago), the CMT Chair has never attended a DORA/CSCRF briefing, and the DR engineer is a single person with no cross-trained alternate.
• Stage 4 (TNA): prioritises: (a) BCM Manager recertification (₹85,000; 4 weeks); (b) CMT DORA briefing (₹35,000; 2 weeks); (c) cross-training a DR engineer deputy (₹2,20,000 over 6 months including vendor DR training); (d) 15 lower-priority actions.
• Stage 5 (TDP execution): books the recertification, schedules the briefing, opens the cross-training plan, executes the lower-priority actions across the year.
• Stage 6 (Effectiveness): the BCM Manager's recertification produces Level 2 evidence (passed exam). The CMT briefing produces Level 3 evidence (line-manager observes more informed challenge-asking in the next CMT meeting). The cross-training produces Level 4 evidence (the deputy executes failover within RTO in the next DR drill).
• Stage 7 (Evidence Records): 42 controlled Competence Evidence Records opened under the LMS, with annual re-validation scheduled.
• Stage 8 (Review): the portfolio is presented to the board Risk Committee quarterly; the IRDAI annual compliance return cites the 7.2 system as evidence of compliance with the IRDAI Information and Cyber Security Guidelines 2023 board-approved training programme requirement.

The total year-one investment: ~₹32 lakh (training, cross-training, LMS configuration, retained-adviser days). The avoided cost: a single IRDAI finding on competence would have cost ₹5–25 lakh in remediation plus reputational drag.

Tools, Technologies, and Solutions

A 7.2 system at lower maturity runs on spreadsheets, documents, and email; at higher maturity it integrates with HR, L&D and BCM/GRC platforms. The categories below are described at the category level, vendor selection is the reader's procurement exercise.

The 7.2 tooling stack

The buy/build decision for a growing company

For a growing company in India (250–2,000 staff), the recommended approach is:

• L1 (CV-and-job-title), no tooling; spreadsheets and email. Total cost: ~₹1–3 lakh of internal effort per year. Capability: minimal. Audit risk: high.
• L2 (spreadsheet + LMS), Competence Matrix on a controlled spreadsheet; an entry-level LMS for training delivery and completion tracking. Total cost: ₹8–20 lakh per year (LMS plus internal effort). Capability: tracks attendance and some learning; weak on behaviour. Audit risk: moderate.
• L3 (integrated LMS + HRIS + BCM module), Competence Matrix in the BCM/GRC module; LMS-HRIS integration; the Evidence Record lives in the GRC platform with controlled access. Total cost: ₹30–80 lakh per year (platform licences plus internal effort plus adviser support). Capability: complete 7.2 system; produces clean audit evidence; weak on behavioural assessment. Audit risk: low.
• L4 (L3 + skills-assessment + simulation platform), adds structured behavioural assessment and exercise/simulation integration. Total cost: ₹50 lakh–₹2 crore per year. Capability: produces Level 3–4 effectiveness evidence; regulator-grade. Audit risk: low.
• L5 (L4 + AI-driven personalisation + sector benchmarking), adds adaptive-learning paths and external benchmarking. Total cost: ₹80 lakh–₹3 crore per year. Capability: differentiated; the system is a strategic asset. Audit risk: minimal.

These figures are category-level mid-market India ranges observed in 2025–2026. They are not Singahi pricing and should be verified against current vendor pricing before procurement.

Specialist advisers and certifications

External advisers and certifying bodies are an important part of the 7.2 system in a growing company. The relevant categories:

• Retained BCM advisers, experienced BCM professionals engaged on a fractional or part-time basis to coach the BCM Manager, design exercises, and evidence competence. Typical: 4–12 days per quarter at ₹1.5–4 lakh per day depending on seniority and sector (BFSI at the high end).
• Crisis simulation providers, specialist firms that design and deliver realistic crisis simulations (tabletop, command-post, full-scale). Typical: ₹5–25 lakh per major simulation in a growing firm.
• BCI / DRI training providers, accredited providers of BCI CBCI cohort programmes and DRI CBCP preparation courses. Typical: ₹65,000–₹1,10,000 plus GST per seat for CBCI; comparable for DRI preparation. BCI also offers in-house cohort programmes at ₹4–8 lakh for a 12–20 person cohort.
• ISACA / ISC2 chapter training, local chapter programmes for CISSP, CISA, CISM preparation. Typical: ₹40,000–₹1,80,000 per participant depending on format.
• Sector-specific training, NISM for capital-markets (SEBI-mandated); IIBF for banking; IAI for actuarial; NABH-aligned for healthcare; CII/FICCI/ASSOCHAM programmes for manufacturing.

Supplier-staff competence verification tools

For supplier-staff competence (cloud DR engineers, managed SOC analysts, work-area-recovery staff), the tools are different:

• Right-of-audit clauses in supplier contracts (mandatory under RBI MD Outsourcing of IT Services 10 April 2023 for BFSI outsourcers).
• Supplier-provided competence registers, the supplier maintains a register of staff who would deliver the service to the client, with their qualifications, certifications, and training currency. Reviewed annually and at contract renewal.
• Joint exercises, the supplier's staff participate in the client's exercises; their performance is part of the evidence.
• Third-party attestations, SOC 2 / ISO 27001 / ISO 22301 certifications of the supplier, which indirectly evidence the supplier's staff competence via their own management systems.
• Supplier-competence audits, periodic on-site or remote audits of the supplier's competence management.

Policy and Procedure Templates

The toolkit accompanying this guide contains a full Competence Management Policy (document 01) and Competence Management Procedure (document 02). This section summarises their structure so the reader can see what the apex 7.2 artefacts look like. The sample "shall" clauses below are Singahi's drafting; they are not reproductions of any standard's text.

Competence Management Policy, structure

1. Purpose and scope. Why the policy exists; which roles it covers; how it relates to the BCMS Policy (Clause 5.2), the enterprise HR policy, and the enterprise L&D strategy.
2. Sanctioned requirement statement. The 7.2 paraphrase: ISO 22301 Clause 7.2 asks organizations to make sure the people doing BCMS work are competent, through education, training, or experience, and to keep evidence of it.
3. Definitions. Competence, qualification, training, education, experience, certification, awareness, BCM Role Taxonomy, Competence Matrix, TNA, TDP, Competence Evidence Record, behavioural competence, key-person risk, supplier competence.
4. The five-dimension competence model. Education, training, experience, certification, behaviour; the four-level rating scale.
5. The eight-stage workflow. A summary of stages 1–8 (see Section 7).
6. Principles. (a) Work-driven competence, competence is derived from the work, not from the incumbent. (b) Triangulated assessment, self, line, BCM Manager, supplier-relationship owner as applicable. (c) Documented evidence, under Clause 7.5 control. (d) Effectiveness measurement, Level 3 evidence required for material interventions. (e) Periodic re-validation, annual for Tier 1; biennial for Tier 2; triennial for Tier 3. (f) Cross-training for key-person risk, every Tier 1 role has a named alternate at Level 2 or above. (g) Supplier-staff competence, contractually evidenced. (h) Continual improvement, advancing role-holders through the levels.
7. Roles, responsibilities and authorities. Top management (accountable); BCM Manager (custodian); Head of HR (HR spine); Head of L&D (delivery); functional heads (their staff); CISO (IS staff); Internal Audit (independent test); Supplier-Relationship Owner (supplier competence).
8. Documented Information requirements. The Competence Evidence Record per role-holder; the Competence Matrix; the TNA; the TDP; the Effectiveness Evaluation record; the re-validation schedule; the key-person risk register; the supplier-competence map.
9. Exceptions and deviations. How to handle a documented competence gap that must be accepted (top-management acceptance; mitigation plan; risk-register entry; remediation date).
10. Review and continual improvement. Annual policy review; management-review input; maturity-advancement targets.
11. Related documents. BCMS Policy (Clause 5.2); Roles, Responsibilities and Authorities register (Clause 5.3); Resource Management Policy (Clause 7.1); Awareness Programme (Clause 7.3); Communication Plan (Clause 7.4); Document Control Procedure (Clause 7.5); BC plans (Clause 8.4); Exercise Programme (Clause 8.5).
12. Approval and revision history. Approved by Top Management; version-controlled per Clause 7.5.

Sample "shall" clauses (organisation-drafted, not the standard's text)

The Competence Management Policy is built from "shall" clauses drafted by the organisation. A representative sample:

• The Organisation shall maintain a BCM Role Taxonomy listing every role whose work affects the BCMS, with role-to-BCMS-criticality mapping (Tier 1, 2, 3).
• The Organisation shall, for each role in the BCM Role Taxonomy, document a Competence Profile specifying the required rating on each of the five dimensions, education, training, experience, certification, and behaviour.
• The Organisation shall assess each role-holder against the relevant Competence Profile at least annually and on trigger events (role change, organisational change, post-incident, post-exercise, regulatory change, supplier change, certification expiry).
• The Organisation shall maintain a Competence Matrix recording, per role-holder and per dimension, the required rating, the current rating, and the gap.
• The Organisation shall, for each identified competence gap, take action to acquire the necessary competence through one or more of the routes, education, training, experience, and through hiring, contracting, mentoring, reassignment, or top-management-accepted risk.
• The Organisation shall evaluate the effectiveness of each material training or development intervention using at least a Level 3 (Behaviour) measure, and shall use the result to inform future Training and Development Plans.
• The Organisation shall maintain, per role-holder in the BCM Role Taxonomy, a Competence Evidence Record under Clause 7.5 document control. The Record shall be complete, current, and signed off by the role-holder, the line manager, and the BCM Manager.
• The Organisation shall ensure that every Tier 1 BCM role has a named alternate assessed at Level 2 or above, and shall maintain a Key-Person Risk Register documenting the cross-training and succession actions.
• The Organisation shall evidence the competence of supplier staff delivering continuity-relevant services through contractual clauses, supplier competence registers, joint exercises, and periodic supplier-competence audits.
• The Organisation shall periodically re-validate the competence of role-holders, annually for Tier 1 roles, biennially for Tier 2, and triennially for Tier 3, and on trigger events.
• The Organisation shall report the competence portfolio to Top Management at every Clause 9.3 management review, including matrix-coverage, gap-closure rate, effectiveness ratings, re-validation currency, key-person-risk status, and supplier-competence status.
• The Organisation shall continually improve the competence system, advancing role-holders through the rating levels and advancing the maturity of the system itself.

Competence Management Procedure, structure

The Procedure operationalises the Policy. It documents the eight-stage workflow (Section 7) in process terms: for each stage, the trigger, the inputs, the activities, the responsibilities, the outputs, the evidence produced, the handoffs to other clauses, and the failure modes. The Procedure is the operating manual the BCM team uses day-to-day; the Policy is the apex commitment Top Management approves.

Document control integration

All 7.2 documents, the Policy, the Procedure, the Role Taxonomy, the Profiles, the Matrix, the TNA, the TDP, the Evidence Records, the Effectiveness records, the re-validation schedule, the key-person risk register, the supplier-competence map, are controlled per Clause 7.5. Version control, access control, retention, and disposition are defined in the Document Control Procedure (Clause 7.5). The Evidence Records are personal data under DPDP Act 2023 and are managed accordingly, minimum necessary, role-based access, defined retention, secure disposition.

Risk Assessment and Treatment

Competence risk is itself a category of operational risk and belongs on the enterprise risk register (Clause 6.1) as well as in the 7.2 system. This section identifies the principal competence-risk categories and the treatment patterns.

Competence-risk categories

The competence risk register

Each identified competence risk is logged on the risk register (Clause 6.1) with: description, source (the matrix entry or the trigger event), BCM-criticality tier, likelihood, impact, current controls, residual risk, treatment plan, owner, review date. The risk register is the bridge between 7.2 and the broader risk management system; a competence risk that is not on the risk register is unmanaged.

The treatment-decision framework

For each competence risk, choose the treatment:

• Avoid, redesign the role so the competence requirement is lower (e.g., simplify the runbook so a less-certified role-holder can execute it).
• Reduce, train, mentor, cross-train, hire, contract to lower the likelihood or impact.
• Transfer, outsource to a supplier whose competence can be evidenced contractually; insure against the consequence (cyber insurance, key-person insurance).
• Accept, with documented top-management acceptance, a mitigation plan, and a remediation date.

The choice depends on the criticality, the cost, and the strategic direction. A growing company will often combine treatments, train the internal team (Reduce) plus engage a fractional BCM Director (Transfer) plus accept a documented gap on a Tier 3 role (Accept) with a mitigation plan.

Sector-specific competence risks

• BFSI. The dominant competence risks are key-person risk (CISO, BCM Manager, head of digital banking), regulatory-change competence risk (the RBI MD, SEBI CSCRF and IRDAI Guidelines create rolling new requirements), and supplier-side attrition risk (cloud and managed-SOC turnover). The treatment is regulator-aligned: documented CISO qualifications, certification tracks for the BCM team, right-of-audit on outsourcers.
• Healthcare. The dominant competence risk is clinical-continuity competence (the ability to maintain safe patient care during a disruption), compounded by behavioural competence under patient-safety stress. The AIIMS Delhi 2022 ransomware (peer-reviewed illustrative scenario) is the canonical example, clinical staff reverted to paper but competence for paper-mode operations had decayed through years of digital reliance.
• IT-ITeS and SaaS. The dominant competence risk is customer-audit competence, the ability to evidence the BCM competence to customers who themselves are regulated. The Cognizant Maze 2020 event (SEC-filed 10-Q/K; $50–70 million Q2 2020 impact) is the canonical example of competence being unevenly distributed across delivery centres.
• Manufacturing. The dominant competence risks are process-safety competence, OT/ICS continuity competence, and supplier-chain continuity competence. The LG Polymers 2020 styrene leak (NGT ₹50 crore interim) is the canonical process-safety competence failure; the Go First 2023 insolvency (engine-supplier concentration) is the canonical supplier-chain continuity failure.
• Government and public sector. The dominant competence risks are constitutional-continuity competence, mutual-aid partner capability, and critical-information-infrastructure protection (IT Act §70A NCIIPC).

Audit and Compliance Checklist

This is the auditor's interview and evidence checklist for Clause 7.2. Use it for self-assessment before a Stage 1 or Stage 2 audit, and for surveillance audits thereafter. Each question lists the expected evidence and the red flag.

A. Governance and policy (5 questions)

1. Is there a Competence Management Policy approved by Top Management, version-controlled per Clause 7.5, and accessible to all BCM role-holders? Expected evidence: the Policy document with approval signatures, version history, distribution record. Red flag: no Policy, or Policy exists but is unsigned and undated.
2. Does the Policy state the sanctioned requirement (the 7.2 paraphrase), the five-dimension model, and the eight-stage workflow? Expected: the paraphrase quoted; the model and workflow summarised. Red flag: Policy asserts competence commitment without operationalising it.
3. Is the Policy linked to the BCMS Policy (Clause 5.2), the enterprise HR policy, and the enterprise L&D strategy? Expected: cross-references in the Policy; aligned terminology; consistent roles. Red flag: Policy is a stand-alone document that contradicts HR or L&D.
4. Does the Policy state the authority levels, who can approve the matrix, sign off on evidence, accept a competence risk? Expected: explicit authority matrix. Red flag: every cell reads "approved by BCM Manager" with no delegation.
5. Is the Policy reviewed at planned intervals and on trigger events? Expected: review schedule (annual minimum); revision history; trigger-event reviews. Red flag: Policy has not been reviewed in 24+ months.

B. BCM Role Taxonomy (4 questions)

6. Is there a BCM Role Taxonomy covering all roles whose work affects the BCMS? Expected: the Taxonomy document; coverage of BCM programme, CMT, IT DR, IS, BCM-adjacent, executive, supplier roles. Red flag: Taxonomy covers only the BCM team.
7. Are supplier roles included in the Taxonomy? Expected: named supplier roles (cloud DR engineer, managed SOC analyst, work-area recovery staff). Red flag: supplier organisation listed but no role granularity.
8. Is each role assigned a BCM-criticality tier (1, 2, 3)? Expected: tier assignment per role; rationale documented. Red flag: no tiering, or every role Tier 1.
9. Is the Taxonomy reviewed at planned intervals and on trigger events (restructure, M&A, new product, new site, new supplier)? Expected: review schedule; trigger-event reviews; revision history. Red flag: Taxonomy out of date vs the current org chart.

C. Competence Profiles and Matrix (4 questions)

10. Is there a Competence Profile per role covering all five dimensions? Expected: Profile per role with education, training, experience, certification, behaviour ratings. Red flag: Profile exists only for the BCM Manager.
11. Is there a Competence Matrix assessing every role-holder against the Profile? Expected: Matrix with required, current, gap per role-holder per dimension. Red flag: Matrix exists but is more than 12 months old, or covers only Tier 1 roles.
12. Is the Matrix triangulated (self, line, BCM Manager, supplier-relationship owner)? Expected: multiple assessor inputs; documented discrepancies and resolution. Red flag: Matrix is self-assessed only.
13. Is the Matrix reviewed on internal-mobility events? Expected: trigger-based re-assessment on every move; quarterly HR–BCM reconciliation. Red flag: role-holder moved 8 months ago but Matrix still shows old role.

D. TNA and TDP (3 questions)

14. Is there a Training Needs Analysis aggregating the gaps into prioritised actions? Expected: TNA document; prioritisation rationale; action types (train/hire/contract/mentor/reassign/accept). Red flag: every action is "send on a course."
15. Is there a Training and Development Plan with dates, owners, budgets, and effectiveness measures per action? Expected: TDP document; budget line under Clause 7.1; effectiveness measures defined per action. Red flag: TDP exists but no budget; or actions have no owner or no date.
16. Is the TDP executed, with completion evidence captured? Expected: completion records (attendance, certificates, exercise ratings). Red flag: TDP shows 30 actions but only 3 have completion evidence.

E. Effectiveness evaluation (3 questions)

17. Is there an Effectiveness Evaluation Design specifying, per intervention type, how effectiveness will be measured (Kirkpatrick L1–L4 or equivalent)? Expected: Design document; per-intervention evaluation plan. Red flag: no Design; ad-hoc evaluation.
18. Are Level 3 (Behaviour) measures captured for material interventions? Expected: line-manager observations at 90 days; exercise-evaluator ratings; peer feedback. Red flag: only Level 1 (reaction surveys) captured.
19. Do effectiveness results feed back into the TNA and TDP? Expected: post-intervention TDP updates; revised gap ratings. Red flag: effectiveness measured but not used.

F. Documented Information (3 questions)

20. Is there a Competence Evidence Record per role-holder, controlled per Clause 7.5? Expected: Record per role-holder in the document-control system; access controls; retention rules. Red flag: evidence scattered across HR files, BCM team files, supplier records with no aggregation.
21. Does each Record contain the full evidence set, qualifications, training, experience, certification, behavioural ratings, sign-offs? Expected: complete Record per role-holder. Red flag: Record contains attendance sheets and a CV but no behavioural ratings or sign-offs.
22. Are Evidence Records retained per DPDP Act 2023 requirements and the enterprise retention schedule? Expected: retention policy aligned with DPDP and Clause 7.5; secure disposition records. Red flag: no retention policy; Records retained indefinitely without basis.

G. Key-person risk and cross-training (2 questions)

23. Is there a Key-Person Risk Register identifying Tier 1 roles and the cross-training/succession treatments? Expected: Register with each Tier 1 role, named alternate, alternate's rating, treatment plan. Red flag: no Register, or Register lists Tier 1 roles but no alternates identified.
24. For each Tier 1 role, is the alternate assessed at Level 2 or above? Expected: alternate's Matrix entry. Red flag: alternate named but not assessed, or assessed below Level 2.

H. Supplier competence (2 questions)

25. Is there a Supplier Competence Map evidencing the competence of supplier staff delivering continuity-relevant services? Expected: Map per supplier; named roles; qualifications and certifications; training currency; exercise participation. Red flag: Map lists suppliers but not named roles.
26. Do supplier contracts contain right-of-audit and notification-of-staff-change clauses (per RBI MD Outsourcing of IT Services for BFSI)? Expected: contract clauses; periodic supplier-competence audits. Red flag: no right-of-audit; no notification clause.

I. Re-validation (2 questions)

27. Is there a periodic re-validation schedule, annual for Tier 1, biennial for Tier 2, triennial for Tier 3, and on trigger events? Expected: schedule; trigger-event re-validations. Red flag: no schedule; re-validations ad-hoc.
28. Are certification renewals (BCI, DRI, ISACA, ISC2, sector-specific) tracked and executed on time? Expected: certification register; renewal calendar; evidence of renewals. Red flag: lapsed certifications; no tracking.

J. Management review and continual improvement (2 questions)

29. Is the competence portfolio reported to Top Management at every Clause 9.3 management review? Expected: management-review input; matrix-coverage, gap-closure, effectiveness, re-validation, key-person, supplier metrics; signed-off decisions. Red flag: competence not on the management-review agenda.
30. Are continual-improvement actions (advancing role-holders through the levels; maturing the system) tracked and executed? Expected: improvement log; maturity-advancement targets (Section 22); trend analysis. Red flag: no improvement actions; static matrix year-over-year.

Scoring guide. A clean run on all 30 is the L4–L5 target. 25–29 conformities with minor observations is the L3 norm. 20–24 conformities indicates L2 with multiple minor non-conformities. Below 20 indicates a Stage 1 major non-conformity on 7.2, likely showstopper for certification.

Metrics and KPIs

A working 7.2 system reports a balanced set of metrics, volume, quality, outcome, integration. The 15 KPIs below cover the full set; the auditor will look for at least 10 reported consistently with trends.

Volume metrics

1. Matrix coverage %, (role-holders with current Competence Matrix entry ÷ total role-holders in BCM Role Taxonomy) × 100. Target: 100% within 12 months of role assignment. Frequency: monthly.
2. Evidence Record completeness %, (role-holders with complete Competence Evidence Record ÷ total role-holders in Taxonomy) × 100. Target: 100%. Frequency: monthly.
3. TDP actions executed ÷ TDP actions planned, execution rate. Target: ≥ 90% within the plan period. Frequency: quarterly.
4. Exercises attended by Tier 1 role-holders ÷ Tier 1 role-holders, exercise participation rate. Target: 100% annually. Frequency: per exercise.

Quality metrics

5. Average gap severity, average (Required − Current) rating across all role-holders × dimensions. Target: decreasing trend; ≤ 0.5 by L4. Frequency: quarterly.
6. Effectiveness Level 3 capture rate, (interventions with Level 3 (Behaviour) evidence ÷ material interventions) × 100. Target: 100% for material interventions. Frequency: per intervention.
7. Triangulation rate, (Matrix entries with self + line + BCM Manager assessments ÷ total Matrix entries) × 100. Target: 100% for Tier 1. Frequency: quarterly.
8. Re-validation currency %, (role-holders re-validated within the schedule ÷ role-holders due for re-validation) × 100. Target: 100%. Frequency: monthly.

Outcome metrics

9. Exercise performance vs RTO/RPO/MBCO, achieved RTO vs target, by role and by exercise. Target: Tier 1 roles meet RTO in ≥ 90% of exercises. Frequency: per exercise.
10. Incident-response performance, time-to-detect, time-to-respond, time-to-recover, by role, by incident. Target: trend improvement; reduction inrepeat incidents. Frequency: per incident; quarterly trend.
11. Audit findings on competence, number and severity of internal and external audit findings specifically on 7.2. Target: zero major non-conformities; trend reduction in minor findings. Frequency: per audit.
12. Certification currency %, (role-holders with current required certifications ÷ role-holders with required certifications) × 100. Target: 100%. Frequency: monthly.

Integration metrics

13. Key-person-risk treatment rate, (Tier 1 roles with cross-trained alternate at Level 2+ ÷ Tier 1 roles) × 100. Target: 100%. Frequency: quarterly.
14. Supplier-competence audit completion rate, (suppliers audited per schedule ÷ suppliers in scope) × 100. Target: 100% per audit cycle. Frequency: per audit cycle.
15. Competence portfolio reporting to management review, yes/no per Clause 9.3 cycle. Target: 100% per cycle. Frequency: per cycle.

Dashboard design

A working competence KPI dashboard presents the 15 metrics with: current value, trend (vs prior period and vs target), commentary (what changed, why, what's next), owner, and link to the underlying evidence. The dashboard is reviewed at every Clause 9.3 management review and reported to the board Risk Committee for BFSI/listed firms. For a growing company, a quarterly PDF dashboard is sufficient at L2–L3; an integrated GRC-platform dashboard is the L4–L5 target.

Cost-of-competence metrics (advanced)

At L4–L5, mature organisations add cost-of-competence metrics:

• Cost per competent role-holder, total 7.2 spend ÷ role-holders at Level 2+. Useful for benchmarking across BUs.
• Cost per gap-closure, total 7.2 spend ÷ gaps closed. Useful for evaluating intervention efficiency.
• ROI of advanced certifications, (avoided cost of competence-driven incidents + audit-pass value + regulator-relationship value) ÷ certification spend. Directional rather than precise.

Common Pitfalls and Audit Failures

The 7.2 system is where many growing companies stumble in certification. The patterns below are named, memorable, and recur across sectors.

The "CV-as-competence" anti-pattern

The role-holder's CV is the only evidence. There is no assessment against the role's actual requirements, no behavioural rating, no exercise performance evidence. The auditor's test is "show me how you know this person is competent beyond their resume"; the answer "they have 12 years of experience" is a finding, not a defence. Fix: populate the Competence Matrix with a current Level 1–4 rating per dimension; back the rating with at least one dated, signed-off artefact per dimension.

The "training-as-attendance" anti-pattern

Training records show attendance at courses but no measurement of whether the training changed behaviour. The auditor's test is "what evidence do you have that the training worked?"; the answer "everyone attended" is a finding. Fix: add Level 3 (Behaviour) measures to material interventions, line-manager observation at 90 days, exercise-evaluator rating at the next exercise, peer feedback.

The "single-BCM-Manager" anti-pattern

The entire BCM programme is one person. There is no alternate, no deputy, no documented succession. The auditor's test is "what happens if your BCM Manager resigns tomorrow?"; the answer "we'd be in trouble" is a major non-conformity. Fix: identify and cross-train a named alternate; engage a retained BCM adviser as a backstop; document the succession plan in the Key-Person Risk Register.

The "matrix-once-a-year" anti-pattern

The Competence Matrix is updated once a year as a compliance exercise. Between updates, role-holders move internally, leave, or change scope, and the matrix is stale. The auditor's test is "walk me through three role-holders who moved in the last six months, show me their matrix updates"; the inability to do so is a finding. Fix: trigger-based re-assessment on every internal move; quarterly HR–BCM reconciliation; rolling matrix currency.

The "supplier-is-competent" assumption

The supplier organisation has ISO 27001 / SOC 2 / ISO 22301 certifications, so the organisation assumes the supplier's staff are competent. The auditor's test is "show me the named individuals who would invoke your runbook and their competence evidence"; the answer "the supplier is certified" is a finding. Fix: supplier-competence register naming the roles; right-of-audit clause; joint exercises; periodic supplier-competence audit.

The "certification-without-renewal" anti-pattern

Role-holders acquired certifications at hire but have let them lapse. The auditor's test is "show me the current standing of each required certification"; expired credentials are a finding. Fix: certification register with renewal calendar; budget line for renewals under Clause 7.1.

The "policy-without-procedure" anti-pattern

The Policy exists but the Procedure does not. The Policy commits to the eight-stage workflow but no one is operating it. The auditor's test is "walk me through the workflow for one role-holder end-to-end"; the inability to do so is a finding. Fix: write the Procedure; train the BCM team on it; operate it day-to-day.

The "awareness-as-competence" anti-pattern

The organisation has delivered Clause 7.3 awareness training to the whole workforce and treats this as satisfying 7.2. The auditor's test is "show me the role-specific competence assessment for the CMT Chair"; the answer "they all did the awareness module" is a finding. Fix: distinguish 7.2 (role-specific) from 7.3 (workforce-wide); maintain both.

The "exercise-without-evidence-capture" anti-pattern

The organisation runs exercises (Clause 8.5) but does not capture exercise performance as competence evidence. The auditor's test is "show me how the exercise performance is reflected in the Competence Matrix"; the answer "we ran the exercise but didn't update the matrix" is a finding. Fix: link the exercise-evaluator ratings to the Matrix; the exercise is the highest-use evidence channel, use it.

The "audit-as-the-annual-event" anti-pattern

Internal audit (Clause 9.2) looks at 7.2 once a year. Between audits, the system drifts. The auditor's test is "show me the mid-year self-assessment"; the absence of in-period monitoring is a finding. Fix: quarterly BCM-team self-assessment against the 30-question audit checklist (Section 11); trend reporting to the BCM Steering Committee.

The "board-is-exempt" anti-pattern

The board Risk Management Committee is treated as exempt from the competence regime because "they are the board". The auditor's test is "show me the BCM-awareness briefing delivered to the board in the last 12 months"; the absence is a finding, and a serious one for BFSI firms where RBI MD IT Governance and SEBI LODR Reg. 21 explicitly require board IT/cyber competence. Fix: annual board BCM briefing; documented board-member competence in the matrix (Tier 1 governance).

The "always-trained-never-exercised" anti-pattern

Role-holders have multiple certifications but have never executed the BC plan under exercise conditions. The auditor's test is "show me the last three exercises this role-holder participated in and their controller's evaluation"; the absence is a finding. Classroom competence and crisis-room competence are different things. Fix: mandatory annual exercise participation for Tier 1 roles; exercise participation as a gating condition for re-validation.

The "everything-is-priority-1" anti-pattern

The TNA treats every gap as priority-1, exhausting the budget on lower-criticality actions while Tier 1 gaps persist. The auditor's test is "show me your prioritisation rationale"; "everything is priority-1" is a finding because it indicates no prioritisation. Fix: prioritise by tier (Tier 1 first), by severity (large gaps first), by trigger urgency (regulatory deadline first); document the rationale.

The "evidence-but-no-effectiveness" anti-pattern

The Evidence Record is thick with certificates and attendance sheets but the effectiveness measures are missing. The auditor's test is "show me the Level 3 (Behaviour) evidence for this material intervention"; the absence is a finding. Fix: bake effectiveness into every material intervention from the design stage; capture Level 3 evidence at 90 days.

The "DPDP-blind" anti-pattern

The Evidence Records contain personal data (CVs, qualifications, behavioural ratings, peer feedback) but are managed as if DPDP Act 2023 does not apply. The auditor's test (especially in the BFSI/healthcare/government sectors) is "show me your retention policy and consent basis for processing this personal data"; the absence is a finding, and a DPDP exposure. Fix: align Evidence Record retention with DPDP Act 2023 and Clause 7.5; minimise the personal data collected; role-based access; secure disposition.

Illustrative Scenario 1: Failure, Konkan Co-operative Bank Limited (Illustrative)

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative scenario. This case is illustrative. It does not report any specific real company, incident, or regulatory action. The characters are composites; the numbers are realistic mid-market India ranges. Use it to understand the failure dynamics, not as a factual account.

The organisation

Konkan Co-operative Bank Limited (KCBL; illustrative name) is a Mumbai-based Urban Co-operative Bank with ₹4,200 crore in deposits, 38 branches across Maharashtra and Goa, 1,150 staff, and a digital-banking stack (mobile banking, internet banking, UPI) handling ~6 lakh transactions per day. KCBL is regulated by the RBI under the Banking Regulation Act, the RBI Cyber Security Framework (2 June 2016), the RBI Complete Cyber Security Framework for UCBs (31 December 2019), and, since 1 April 2024, the relevant provisions of the RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices.

The BCM and competence posture before the event

KCBL had achieved ISO 22301:2019 certification 14 months before the event. The BCMS documentation was clean, a board-approved BCMS policy, a documented BIA with RTO of 4 hours for digital banking and 8 hours for core banking, a strategy document committing to a managed-DRS with a 4-hour recovery SLA, BC plans for the CMT and IT DR, and an annual exercise calendar.

The competence posture, however, was thin. The BCM role was held by Rahul Deshpande (illustrative name), the bank's Head of Operations, dual-hatted with no formal BCM qualification. Rahul had attended a 2-day ISO 22301 awareness programme three years earlier; his only BCM training was the certification readiness coaching during the ISO engagement. There was no BCM Coordinator network, Rahul handled BCM alongside operations. The CMT was the bank's Management Committee (CEO, COO, CFO, CIO, Head of Credit); none had received crisis-management training beyond a 90-minute briefing at the start of the ISO engagement. The DR engineer was a single contracted individual from the bank's IT services vendor; the vendor's competence register named him, but no alternate was identified.

The Competence Matrix existed, produced during the ISO engagement, but had not been updated since certification. The Training and Development Plan listed 14 actions; 11 were incomplete. The Effectiveness Evaluation Design did not exist. The Competence Evidence Records were three Excel files in Rahul's personal network drive. The Key-Person Risk Register did not exist. The Supplier Competence Map named the vendor's organisation but not the named individuals.

The event

On a Saturday in late October, a ransomware attack encrypted the bank's primary data centre, including the core banking system's database, the digital banking middleware, and the file shares holding the previous night's incremental backups. The bank's DRS, hosted at the IT vendor's facility in Pune, was invoked the same evening. The DRS restoration was targeted to a 4-hour RTO per the BIA.

The DRS engineer (the single contracted individual) was unreachable for the first three hours, he was at a family function in rural Maharashtra with poor connectivity. When he came online, he discovered that the DRS configuration had drifted from the production environment (a middleware upgrade two months earlier had not been propagated to DRS, a Clause 8.5 exercise failure, not just a 7.2 failure). He could not complete the restoration within the 4-hour RTO.

Rahul Deshpande, as BCM Manager (dual-hatted), was also unreachable for the first two hours, he was travelling and his phone was switched off. The CMT convened without him; the CEO, acting as CMT Chair without prior crisis-room training, struggled to make delegation decisions. The bank's crisis communications lead, the Head of Marketing, with no formal crisis-comms training, drafted a customer notice that understated the incident and was later criticised by RBI for being misleading.

The restoration took 19 hours against a 4-hour RTO. Digital banking was dark for 31 hours. The bank reported the incident to CERT-In at the 11-hour mark (5 hours late against the 6-hour CERT-In clock under the 28 April 2022 Direction) and to RBI at the 28-hour mark (later than the RBI Cyber Security Framework expectation).

The consequences

The RBI supervisory team arrived the following week. The findings (illustrative composite of typical RBI enforcement):

• RBI finding 1 (Major non-conformity on Clause 7.2): The bank could not evidence the competence of the BCM Manager, the CMT, or the DR engineer at the time of the event. The Competence Matrix was 14 months old. The Evidence Records were not controlled. There was no BCM Coordinator network. There was no alternate for the DR engineer or the BCM Manager. The Key-Person Risk Register did not exist.
• RBI finding 2 (Major non-conformity on Clause 7.5 + CERT-In): Documented Information of competence was not maintained under control; the bank could not produce, in the first hour of the supervisory visit, the competence evidence for any role-holder.
• RBI finding 3 (Major non-conformity on RBI Cyber Security Framework): The SOC manpower was inadequate; the incident was detected by a customer complaint, not by the SOC; the 6-hour CERT-In reporting clock was missed.
• RBI finding 4 (Major non-conformity on RBI MD Outsourcing of IT Services): The vendor's competence register was not evidenced; the right-of-audit clause was in the contract but had never been exercised; the vendor's staff change (the DR engineer was a recent replacement for the previous engineer) had not been notified to the bank.

The RBI imposed a monetary penalty of ₹1 crore under the Banking Regulation Act, restricted the bank from onboarding new digital-banking customers for 6 months, and required an external IT audit at the bank's cost (₹1.8 crore for a mid-tier UCB). The bank's ISO 22301 certification was suspended by the certification body pending corrective action.

The root-cause analysis through the 7.2 lens

The root cause was not technical (the ransomware), strategic (the DRS architecture), or procedural (the BC plans). The root cause was competence-system failure:

1. Duty 1 (Determine competence) failed. The Competence Profiles did not exist for the BCM Manager, the CMT Chair, or the DR engineer in any meaningful sense. The Profiles produced during the ISO engagement were generic and unreviewed.
2. Duty 2 (Acquire competence) failed. The TDP listed actions but they were not executed. Rahul had not received formal BCM training in three years. The CMT had never trained together. The DR engineer was a recent replacement with no documented handover.
3. Duty 3 (Evidence competence) failed. The Evidence Records were incomplete, uncontrolled, and not under Clause 7.5. The Key-Person Risk Register did not exist. The Supplier Competence Map named the organisation but not the individuals.

The lessons (transferable)

• ISO 22301 certification is not a competence floor. The bank achieved certification on documentation, not on capability. The competence system was a paper artefact.
• A dual-hatted BCM Manager is a single point of failure. The dual-hatting was the single largest contributor to the cascade; Rahul could not be both Operations Head and BCM Manager during a disruption.
• The vendor's named individuals matter more than the vendor's organisation. The DRS SLA was a contractual number; the actual restoration depended on one individual who was unreachable.
• The CMT Chair role is behavioural, not titular. The CEO was a capable executive but had never been trained in crisis-room decision-making. The training gap showed.
• CERT-In's 6-hour clock is unforgiving. A PoC who is unreachable is functionally the same as no PoC. The competence requirement includes contactability.
• The RBI treats competence as a board-level governance matter. The finding was not "the BCM Manager was untrained"; the finding was "the board did not ensure the BCM Manager was competent." The board-level accountability under Companies Act §134(3)(n) and the RBI MD IT Governance is non-delegable.

The remediation programme, guided by a new fractional BCM Director, took 14 months and ₹6.2 crore (including the penalty, the external audit, the new BCM team, the re-platformed DRS, the re-certification, and the customer-remediation costs). It is a textbook example of the cost of getting 7.2 wrong.

Illustrative Scenario 2: Success, Sharda Logistics Private Limited (Illustrative, with ROI)

Illustrative scenario. This case is illustrative. It does not report any specific real company. The numbers are realistic mid-market India ranges. Use it to understand the success dynamics and the ROI logic, not as a factual account.

The organisation

Sharda Logistics Private Limited (illustrative name) is a Pune-based third-party logistics (3PL) company with 1,650 staff, 42 warehouses across India, and a technology stack (warehouse management, fleet tracking, customer portal) handling ~2.5 lakh shipments per day for 38 enterprise customers in retail, automotive, and pharma. Sharda is regulated indirectly, its pharma customers (Sun Pharma, Cipla, Dr Reddy's-grade customers) impose GxP and GDP (Good Distribution Practice) compliance contractually; its automotive customers impose IATF 16949 continuity expectations; its BFSI customers (transporting ATM cash and bullion) impose RBI-aligned continuity expectations.

The challenge

In early 2024, Sharda's largest customer (an automotive OEM, ~22% of revenue) issued a supplier-continuity questionnaire that required evidence of: (a) a documented BCP/DR; (b) ISO 22301 certification or equivalent; (c) demonstrated competence of the BCM team and the CMT; and (d) key-person risk treatment with named alternates. The customer gave Sharda 9 months to comply or face contract renegotiation. Sharda's BCM "programme" was, in reality, an Excel-based DR plan that had not been updated in two years. The BCM role was held by the Head of IT (also dual-hatted); the CMT had never met as a CMT; the DR engineer was an internal staff member who had not been trained on the new WMS recovery runbook.

Sharda's CEO, Priya Sharma (illustrative name), engaged a fractional BCM Director (4 days per month at ₹1.8 lakh per day) and committed an internal budget of ₹80 lakh to a 12-month competence programme. The investment thesis: the automotive customer alone was worth ₹140 crore per year in revenue; a 9-month competence build was a small premium to protect that revenue, and the same programme would satisfy 6 other enterprise customers' supplier-continuity questionnaires.

The competence programme (the 7.2 system build)

The 12-month programme followed the eight-stage workflow (Section 7):

• Stage 1 (Role Taxonomy): identified 47 BCM-relevant roles, BCM Director (fractional), BCM Manager (Head of IT, transitioning to a dedicated hire in month 6), 4 regional BCM Coordinators, CMT (10 + alternates), DR team (3 + 1 cross-trained), BCM-adjacent (HR, Facilities, Procurement, Legal, Communications), executive sponsors (CEO, COO, board Risk Committee), supplier roles (cloud DR, managed SOC, work-area recovery).
• Stage 2 (Profiles): wrote 47 Competence Profiles. The BCM Manager profile required BCI CBCI minimum (DRI CBCP accepted); the regional Coordinator profile required internal certification; the DR engineer profile required vendor-specific certifications; the CMT Chair profile required crisis-leadership training.
• Stage 3 (Matrix): assessed all 47 role-holders. 32 gaps identified, most consequentially, the BCM Manager (Head of IT) had no formal BCM training; 3 of the 4 Coordinators had no BCM background; the DR team had no cross-trained alternate; the CMT had never trained together.
• Stage 4 (TNA): prioritised: (a) BCM Manager BCI CBCI certification (₹95,000, 6 weeks); (b) 4 Coordinator internal certification programme (₹3.2 lakh, 12 weeks); (c) DR engineer cross-training of an alternate (₹2.4 lakh, 6 months); (d) CMT crisis-leadership programme for 10 + alternates (₹14 lakh for a 3-day simulation-led programme with a specialist provider); (e) 22 lower-priority actions across the year.
• Stage 5 (TDP execution): executed across the year. The BCM Manager passed the CBCI exam in month 3. The Coordinators completed internal certification in month 4. The DR alternate completed vendor DR training in month 6 and led the November DR drill in month 9. The CMT completed the crisis-leadership programme in month 5 and ran their first major simulation (a ransomware scenario) in month 8.
• Stage 6 (Effectiveness): Level 3 (Behaviour) evidence captured at 90 days post-intervention. The BCM Manager's exercise-controller rating in the November drill was Level 3 (Proficient), up from Level 1 (Awareness) at the start of the programme. The DR alternate executed the November drill within RTO. The CMT's simulation performance (controller's rating) went from "struggled to delegate" in month 1 to "clean delegation, fast escalation, accurate regulator engagement" in month 8.
• Stage 7 (Evidence Records): 47 controlled Competence Evidence Records opened in the new BCM/GRC platform (₹18 lakh per year licence), integrated with the HRIS and the LMS.
• Stage 8 (Review): the competence portfolio reported quarterly to the CEO and bi-annually to the board Risk Committee. The automotive customer's supplier-continuity audit in month 10 returned a clean result.

The exercise that proved the system

In month 11, Sharda experienced a real event, a Chennai-floods-scale monsoon event submerged two of its warehouses (Chennai and Sri City), knocking both offline for 9 days. The BIA-derived RTO for the affected customer shipments was 48 hours; the strategy committed to a work-area-recovery arrangement in Bengaluru and a manual fallback for the WMS.

The CMT convened within 90 minutes of the warehouse submersion being confirmed. The CEO (CMT Chair) led the room with the discipline of the month-8 simulation; delegation was clean; the customer-comms lead (one of the Coordinators, by now Level 3 on comms) drafted an accurate, non-misleading customer notice within 3 hours. The DR team failed over the WMS to the Bengaluru recovery site within 36 hours (within the 48-hour RTO). The regional BCM Coordinator (one of the internally-certified cohort) coordinated the workforce evacuation and the mutual-aid engagement with the local SDMA.

The recovery RTO was met for 38 of the 40 affected customer lanes. The two lanes that missed RTO were communicated proactively to the affected customers, with realistic revised ETAs. No customer cancelled. The automotive customer (whose supplier-continuity audit had passed in month 10) sent a commendation note.

The ROI

The 12-month programme cost ₹80 lakh (fractional BCM Director ₹86 lakh was the largest line, but offset against avoided recruitment cost; BCM/GRC platform ₹18 lakh; training and certification ₹22 lakh; simulation provider ₹14 lakh; internal effort ₹10 lakh; contingencies). Net cash outlay after offsetting the avoided recruitment: ~₹52 lakh.

The avoided cost / value created:

• Automotive customer retention: ₹140 crore per year in revenue protected (a 27x annualised return on the ₹52 lakh net spend, even at a 5% margin).
• Multi-customer use: the same 7.2 evidence set satisfied 6 other enterprise customers' supplier-continuity questionnaires (estimated value: ₹40 crore per year of contract value protected, with renegotiation-avoidance value of ₹3–5 crore per year).
• Insurance premium reduction: the bank's cyber and BI insurer reduced the premium by 18% on policy renewal (the BCM/GRC-platform evidence of competence was the principal driver), saving ₹22 lakh per year.
• Faster incident response: the Chennai-event recovery within RTO avoided an estimated ₹4.5–7 crore of customer-claim exposure (based on the contractual penalties in the customer SLAs).
• Brand and recruitment: the demonstrable competence programme became a recruiting asset for senior operations and IT hires, with two senior hires in 2025 citing it as a deciding factor.

The first-year ROI was approximately 6x on a cash basis and 30x+ on a revenue-at-risk basis. The programme became a recurring line in the annual budget (₹30–40 lakh per year recurring from year 2), and the maturity advancement target (Section 22) was set at L4 by end of year 2 and L5 by end of year 3.

The lessons (transferable)

• Competence is a customer-facing asset, not just an internal discipline. In B2B contexts, the 7.2 evidence set is part of the sales proposition. Sharda's investment paid back through customer retention, not just risk avoidance.
• Cross-training is the highest-use spend. The DR alternate who executed the November drill within RTO was the single highest-ROI development action in the programme.
• Simulation-led development dominates classroom training. The CMT's month-8 simulation produced more measurable behaviour change per rupee than any other intervention. Sharda's leadership now requires simulation participation as a gating condition for Tier 1 re-validation.
• The 7.2 system pays back in adjacent domains. The insurer's premium reduction and the recruitment-market effect are realisations of competence-as-asset that go well beyond the original ISO 22301 motivation.
• The fractional BCM Director model works for growing firms. Sharda could not justify a full-time BCM Director at ₹60–90 lakh per year. The fractional model (₹65 lakh per year for 4 days per month) was the bridge to a defensible 7.2 system while the internal team built capability.

Multi-Framework Mapping

The table below maps ISO 22301 Clause 7.2 to the principal adjacent frameworks and Indian regulations. Use it for integrated management-system audits, customer due-diligence questionnaires, and regulatory mapping exercises.

Using the mapping

The mapping has three principal uses:

• Integrated management-system audits. An organisation running ISO 22301 + ISO 27001 + ISO 9001 + SOC 2 should run a single competence system that satisfies all four; the mapping is the evidence the integrated-audit team will use to avoid duplicate sampling.
• Customer due-diligence questionnaires. Enterprise customers (especially in BFSI, healthcare, and government) issue supplier questionnaires that probe competence; the mapping converts the 7.2 evidence set into the customer's preferred framework's language.
• Regulator engagement. When the RBI, SEBI, IRDAI or CERT-In asks for evidence of competence, the mapping converts the 7.2 evidence set into the regulator's preferred instrument's language, e.g., "the BCM Manager's Competence Evidence Record satisfies the IRDAI Guidelines' board-approved training programme requirement and the RBI MD IT Governance's qualified-personnel expectation."

Implementation Roadmap

A working 7.2 system is built over 12 months for a growing company and over 6 months for an enterprise refresh. The roadmap below is the recommended sequence; tailor it to your context.

Days 0–30, Foundation

• Day 1: CEO/MD signs the Competence Management Policy charter; BCM Manager (or fractional BCM Director) appointed as custodian.
• Day 1–5: Read this guide end-to-end (BCM Manager + Head of HR); read the existing BCMS Policy (Clause 5.2), the Roles, Responsibilities and Authorities register (Clause 5.3), and the Resource Management Policy (Clause 7.1).
• Day 5–15: Draft the Competence Management Policy (use toolkit document 01) and the Competence Management Procedure (use toolkit document 02). Circulate to the BCM Steering Committee and the Head of HR for review.
• Day 15–25: Customise the BCM Role Taxonomy template (toolkit document 09) and the Competence Profile template (within toolkit document 09). Walk the BC plans, the CMT roster, the supplier register, and the org chart.
• Day 25–30: Top Management approves the Policy and the Procedure. The BCM Role Taxonomy v1 is published.

Investment: 25–40 person-days of internal effort; ₹3–8 lakh (including any retained-adviser days for Policy drafting). Outcome: the apex 7.2 artefacts in place; the Role Taxonomy v1 published.

Days 31–90, Assessment

• Day 31–45: Build the Competence Profile per role (use toolkit document 09 Part B). Train the assessor pool (BCM Manager + line managers + supplier-relationship owners) on the five-dimension model and the four-level scale.
• Day 45–80: Assess every role-holder in the BCM Role Taxonomy against the relevant Profile. Populate the Competence Matrix (toolkit document 09 Part C). Run the 90-minute competence-back-fill workshop (Section 1 "Quick win") with the BCM Manager, Head of HR, CIO, CISO, Head of Operations.
• Day 80–90: Build the Training Needs Analysis (toolkit document 08) from the Matrix gaps. Prioritise. Decide the action type per gap. Present the TNA to the BCM Steering Committee for budget approval.

Investment: 50–80 person-days of internal effort; ₹8–18 lakh (including assessor training, retained-adviser support, and the workshop). Outcome: the Competence Matrix populated; the TNA published; the TDP budget approved.

Days 91–180, Build

• Day 91–120: Execute the highest-priority TDP actions, typically: (a) BCM Manager external certification (BCI CBCI or DRI CBCP); (b) CMT crisis-leadership programme; (c) DR engineer cross-training of an alternate; (d) key supplier-competence audit.
• Day 120–150: Configure the LMS and/or the BCM/GRC module to host the Competence Matrix and the Evidence Records. Migrate the spreadsheet data into the system. Establish access controls and retention rules.
• Day 150–180: Open the controlled Competence Evidence Record per role-holder (toolkit document 11). Migrate existing evidence (CVs, certificates, training records) into the Records. Begin capturing new evidence (the post-certification exam results, the CMT programme ratings).

Investment: 80–120 person-days; ₹15–40 lakh (including certifications, CMT programme, LMS/GRC configuration, supplier audit). Outcome: the TDP in execution; the Evidence Records opened; the LMS/GRC configured.

Days 181–270, Validate

• Day 181–210: Run the first post-build exercise (Clause 8.5), a tabletop or simulation that exercises the CMT and the DR team. Capture exercise-evaluator ratings per role-holder. Update the Competence Matrix with the exercise performance.
• Day 210–240: Capture Level 3 (Behaviour) evidence at 90 days post-intervention for the highest-priority actions. Update the Matrix with the effectiveness results.
• Day 240–270: Run the first internal audit (Clause 9.2) of the 7.2 system using the 30-question checklist (Section 11). Log findings; corrective actions into the TDP.

Investment: 60–90 person-days; ₹10–25 lakh (including exercise, internal audit, corrective actions). Outcome: the system validated; the loop closed.

Days 271–365, Sustain

• Day 271–300: Present the competence portfolio at the Clause 9.3 management review (toolkit document 11 dashboard). Top Management signs off on accepted risks; next cycle's TDP budget approved.
• Day 300–330: Begin the periodic re-validation cycle, Tier 1 role-holders due for annual re-validation are re-assessed. Supplier-competence audits scheduled.
• Day 330–365: Year-end review. Update the maturity assessment (Section 22). Set year-2 maturity-advancement targets. Renew the Policy and the Procedure. Submit the IRDAI/SEBI/RBI compliance reports as applicable.

Investment: 40–60 person-days; ₹5–15 lakh (including re-validation, supplier audits, year-end review). Outcome: the system sustained; year-2 plan approved.

Total year-1 investment

Recurring annual cost from year 2 is typically 40–60% of the year-1 cost (the build cost is not repeated; the certification renewals, the LMS/GRC subscription, and the recurring training continue).

Sequencing for a firm under regulatory pressure

If the firm is under an existing regulator-driven remediation (RBI finding, SEBI direction, IRDAI audit, DPDP breach) the sequencing is compressed:

• Weeks 1–2: Competence Policy and Procedure approved; Role Taxonomy v1 published.
• Weeks 3–6: Matrix populated; TNA published; TDP budget approved under emergency authority.
• Weeks 7–16: Highest-priority TDP actions executed; Evidence Records opened.
• Weeks 17–24: First internal audit; management review; regulator-progress report.
• Weeks 25–52: Normal-cadence sustain.

The compressed sequence is more expensive (₹50 lakh–₹2 crore for a growing firm) but is the only credible response to a regulator-driven timeline.

FAQ

Q1. Does ISO 22301 Clause 7.2 require every BCM role-holder to have a BCI or DRI certification? No. The clause requires the organisation to determine the necessary competence for each role and then to act to acquire it. Certification is one route, often the most evidentially clean, but not the only one. A small organisation may legitimately determine that experience plus internal training is sufficient. A regulated bank will almost always require external certification for the BCM Manager and CISO roles. The test is whether the determination is reasoned and the action is taken.

Q2. We are a 200-person SaaS company. Can the BCM Manager be the CIO dual-hatted? It is possible but it is a structural risk. The dual-hatting concentrates two Tier 1 BCM roles in one person, and the Konkan Co-operative Bank scenario (Section 14) shows how this compounds during a disruption. The better answer, in most growing companies, is to appoint a BCM Manager (could be the Head of Operations, Head of IT, or a dedicated hire) and engage a fractional BCM Director (4–8 days per month) for senior-level competence. The fractional model is widely used and defensible to auditors and regulators.

Q3. Our BCM Manager has 15 years of operations experience but no BCM certification. Is that a non-conformity? Not necessarily. The competence assessment is the test. If the assessment shows that the BCM Manager's experience translates into demonstrable BCM competence (e.g., they have led multiple exercises, they understand the BIA, they can brief executives, they have been observed in a simulation), the absence of a certification is not in itself a non-conformity. However, for BFSI firms under the RBI MD IT Governance (eff. 1 Apr 2024) and for SEBI-regulated MIIs, the expectation is moving toward explicit certification. The safer posture is to invest in the certification (BCI CBCI or DRI CBCP is the floor).

Q4. How do we evidence supplier-staff competence when the supplier organisation is ISO 27001 / ISO 22301 certified? The supplier's organisation-level certification is necessary but not sufficient. The evidence you need is at the individual level, the named supplier staff who would actually invoke your runbook. The minimum: (a) a contractual right-of-audit clause (mandatory under RBI MD Outsourcing of IT Services for BFSI); (b) a supplier-competence register naming the individuals with their qualifications, certifications, and training currency; (c) joint exercises where the supplier's staff participate and you capture the controller's ratings; (d) periodic supplier-competence audits (annual or biennial).

Q5. How often should the Competence Matrix be updated? Annually is the floor; on-trigger is the practice. Triggers include: role-holder change (joiner, mover, leaver); organisational change (restructure, M&A, new business line, new site); post-incident (Clause 8.6 / 10.1); post-exercise (Clause 8.5); regulatory change (RBI/SEBI/IRDAI/CERT-In updates); supplier change (contract renewal, supplier personnel change); certification expiry. A matrix updated only annually is stale for 364 days; the audit test is "walk me through three role-holders who moved in the last six months, show me their matrix updates."

Q6. Is workforce-wide BCM awareness training (Clause 7.3) sufficient to satisfy 7.2? No. Clause 7.3 awareness is the workforce-wide baseline, every employee knows the policy, their role, and the consequences of non-compliance. Clause 7.2 competence is the role-specific regime for the people who do BCM work. The boundary is the BCM Role Taxonomy: in-taxonomy roles are 7.2; everyone else is 7.3. A BCMS that conflates them is non-conformant on one or both.

Q7. Our board members are senior executives. Are they in scope of 7.2? Yes, for the BCM-relevant slice of their role. The board Risk Management Committee (under Companies Act §134(3)(n), §177, SEBI LODR Reg. 21) has explicit BCM oversight responsibilities; the competence to discharge those responsibilities is in scope. For BFSI, the RBI MD IT Governance explicitly expects board-level IT competence. The minimum evidence: annual BCM briefing delivered to the board, documented in the board minutes; each board-member's competence on the BCM-oversight slice captured in the matrix.

Q8. What is the difference between competence and qualification? Qualification is a formal recognition (degree, certificate) attesting that the holder has met a defined standard. Competence is the demonstrated ability to apply the knowledge, skill, and behaviour required by the role. Qualifications are evidence of potential competence; competence is the application of that potential in role. The 7.2 system measures competence, with qualifications as one of five dimensions of evidence.

Q9. How do we handle a competent role-holder who refuses to participate in exercises or assessments? The refusal is itself a competence finding, the role-holder is not demonstrating the behavioural dimension (judgement, cooperation, self-awareness). The honest responses are: (a) coach the role-holder on why participation is required (the exercise is the principal evidence channel); (b) reassign the BCM-critical slice of the role to a willing alternate; (c) escalate to top management as a non-conformity risk; (d) if unresolved, accept the role-change with a documented TDP action. A role-holder who refuses to evidence competence is, in effect, declining to be competent in role.

Q10. Can we use ISO 27001:2022 Clause 7.2 evidence to satisfy ISO 22301 Clause 7.2? Yes, if you run an integrated competence system. The two clauses have identical Harmonized Structure; an integrated workflow satisfies both. The added 22301-specific element is the BCM Role Taxonomy and the BCM-relevant Profile detail, these are additions to the ISMS evidence, not separate evidence. An integrated ISMS+BCMS audit will sample the integrated evidence once.

Q11. What is the typical cost of certifying the BCM team? Category-level mid-market India ranges (2025–2026): BCI CBCI cohort seat ₹65,000–₹1,10,000 plus GST; DRI CBCP preparation course ₹80,000–₹1,50,000 plus exam fee; CISSP preparation plus exam ₹80,000–₹1,80,000; CISA/CISM/CRISC preparation plus exam ₹60,000–₹1,40,000 each; sector-specific (NISM, NCFM, IIBF) ₹15,000–₹60,000 per paper. Re-certification and continuing-education costs are typically 15–25% of the initial cost per year. These are category-level ranges; verify against current pricing before procurement.

Q12. What happens if a Tier 1 role-holder resigns with no notice? The Key-Person Risk Register is the answer. For each Tier 1 role, the register should have: a named alternate assessed at Level 2 or above; a documented succession plan (internal or external); a retained-adviser backstop (for the BCM Manager and CISO roles); a 30/60/90-day transition plan; a controlled Competence Evidence Record that survives the departure. A resignation that triggers a BCMS non-conformity is itself a 7.2 finding, the system should have anticipated it.

Q13. Our CMT has never trained together. Where do we start? Start with a 4-hour tabletop (Clause 8.5) using a familiar scenario (a prolonged power outage; a ransomware event; a key supplier failure). Use an external facilitator for the first exercise (the internal team will not challenge itself effectively). Capture the controller's observations per CMT member and use them as Level 3 (Behaviour) evidence in the Competence Matrix. Repeat quarterly for the first year; move to a half-day simulation in year 2; move to a full-day major simulation in year 3.

Q14. How do we satisfy DPDP Act 2023 for the Competence Evidence Records? The Evidence Records contain personal data (CVs, qualifications, behavioural ratings, peer feedback, mentor sign-offs). DPDP-compliant handling requires: (a) a stated purpose (BCMS competence management); (b) minimum-necessary collection (don't collect data you don't need); (c) role-based access (only the BCM Manager, Head of HR, and the role-holder's line manager should see the full Record); (d) defined retention (align with enterprise HR retention + Clause 7.5; typically 7 years post-departure for BCM-critical roles); (e) secure disposition at end-of-retention; (f) the role-holder's rights (access, correction) honoured. The Records should also be reviewed for breach risk under §8(5), they are themselves availability-sensitive data.

Q15. Can AI tools replace the BCM Manager? No. AI tools can support the BCM Manager (e.g., drafting plan documents, generating scenarios, summarising exercise notes, surfacing regulatory changes, generating draft Evidence Records). They cannot be the BCM Manager, the role requires judgement under uncertainty, board engagement, regulator engagement, and the behavioural dimensions that are not (yet) AI-addressable. The mature posture is to use AI to amplify the BCM Manager, freeing their time for the human-judgement work. A BCMS that defers to an AI for Tier 1 competence is non-conformant on 7.2.

Industry-Specific Requirements

BFSI (banks, NBFCs, insurers, MIIs, PSOs)

The most regulated sector for 7.2. Key instruments:

• RBI MD IT Governance (eff. 1 Apr 2024), board and senior-management IT competence; qualified personnel staffing BCP/DR; competent IS auditors.
• RBI Cyber Security Framework (2 Jun 2016), board cyber-literacy; 24x7 SOC manpower; FM competence; IR-staff competence.
• RBI MD Outsourcing of IT Services (10 Apr 2023), outsourcer-staff competence must meet RE standards.
• RBI Complete Cyber Security Framework for UCBs (31 Dec 2019), tiered competence expectations.
• SEBI CSCRF (20 Aug 2024), 5-category manpower scaling; qualified CISO; periodic training.
• SEBI MII BCP-DR (22 Mar 2021), key-person risk; cross-training; drill participation as competence evidence.
• IRDAI Information and Cyber Security Guidelines (24 Apr 2023), board-approved training programme; CISO qualifications; DR-drill competence.

BFSI-specific competence roles in scope of 7.2: Board (Risk Management Committee, Audit Committee); CEO/MD; CIO; CISO; BCM Manager; Head of Digital Banking; Head of Operations; SOC Manager and analysts; IS-audit lead; DR Manager and engineers; CMT (8–12); BCM-adjacent (Legal, Compliance, HR, Communications, Procurement, Facilities); Company Secretary. Plus supplier roles for cloud DR, managed SOC, work-area recovery.

BFSI-specific certifications expected: BCI CBCI / DRI CBCP for BCM leadership; CISSP / CISM / CRISC for CISO and IS leadership; CISA for IS auditors; NISM Series XI-B/XV for compliance officers; NCFM/NISM for capital-markets staff; IIBF for banking-specific roles.

Investment range: ₹80 lakh–₹4 crore per year recurring for an enterprise; ₹30–80 lakh per year for a growing firm.

Healthcare (hospitals, pharma, diagnostics, health-tech)

Patient-safety competence dominates. Key instruments:

• NABH accreditation standards, explicit BCM expectations for accredited hospitals; NCSIH and clinical-continuity credentials for clinical leaders.
• Drugs and Cosmetics Act 1940 + GxP / GDP, for pharma manufacturing and distribution.
• DPDP Act 2023, health data is sensitive; competence on data availability is heightened.
• Clinical Establishments Act 2010, for clinical establishments (where applicable).

Healthcare-specific competence roles: Hospital Administrator (CMT Chair); Medical Superintendent; Nursing Director; Head of Pharmacy; Head of Laboratory; Head of IT/Health-IT; BCM Manager; CISO; CMT (clinical and administrative mix); supplier roles for biomedical-equipment maintenance, health-IT DR.

Healthcare-specific certifications: NCSIH for clinical continuity; NABH-aligned internal certifications; CISSP / HCISPP for health-IT security; clinical-specialty certifications.

Investment range: ₹15–60 lakh per year for a mid-market hospital network.

IT-ITeS and SaaS

Customer-contractual competence dominates. The firm's BCM competence is itself a product feature, evidenced in SOC 2 audits, in customer due-diligence questionnaires, in industry-specific certifications.

Key instruments:

• SOC 2 (TSP 2017, with 2022 points of focus), CC1.1, CC2.2, CC3.1, CC7.4 on competence and accountability.
• ISO/IEC 27001:2022, Clause 7.2 + A.5.10 for ISMS competence.
• DORA (for firms serving EU financial entities), Art 5(4), Art 13, Art 19.
• Customer contracts, bespoke BCM-clause and supplier-staff-competence clauses.

IT-ITeS-specific competence roles: Delivery Manager (often CMT Chair); BCM Manager; CIO/CISO; DR team; SOC; per-customer delivery leads; per-customer BCM liaisons; supplier-staff for cloud, SaaS dependencies.

IT-ITeS-specific certifications: BCI CBCI / DRI CBCP for BCM; CISSP/CISM/CCSP for security; ITIL 4 for service management; vendor-specific cloud certifications.

Investment range: ₹25 lakh–₹1 crore per year for a growing SaaS firm.

Manufacturing (chemical, automotive, electronics, pharma manufacturing)

Industrial-continuity competence dominates. Key instruments:

• NDMA DM Act 2005 + NDMA Chemical Disaster Guidelines 2007, emergency-response personnel competence.
• Factories Act 1948 + state Factories Rules, safety officers' competence.
• IATF 16949 (automotive), ISO 13485 (medical devices), GMP (pharma), sector-specific QMS+BCM competence.
• Environment Protection Act 1986 + PCBCs (state pollution control), environmental-emergency competence.

Manufacturing-specific competence roles: Plant Manager (CMT Chair); Head of Operations; Head of EHS (Environment, Health, Safety); Head of Process Safety; Head of Maintenance; Head of IT/OT; BCM Manager; CMT (plant and corporate mix); on-site emergency-response team; mutual-aid partners.

Manufacturing-specific certifications: NEBOSH / IOSH for EHS; process-safety certifications (CCPS); OT/ICS security certifications (GICSP); BCI/DRI for BCM leadership.

Investment range: ₹20 lakh–₹80 lakh per year for a mid-market manufacturer; higher for chemical/MAH units.

Government and public sector

Constitutional-continuity competence dominates. Key instruments:

• DM Act 2005 + NDMA guidelines, National Disaster Management Plan (NDMP), state and district DMPs.
• IT Act §70A (NCIIPC) + §70B (CERT-In), for critical-information-infrastructure operators.
• MeitY Cloud First / Government Cloud / MeitY Empanelment of Cloud, for cloud providers serving GoI.
• CAG's auditing standards, for BCM-audit competence of government auditors.
• Sector-specific ministry guidelines (e.g., Ministry of Power for grid continuity; Ministry of Telecom for telecom continuity).

Government-specific competence roles: Secretary/Principal Secretary (CMT Chair at the department/ministry level); Head of IT/e-Governance; CISO; BCM Nodal Officer; CMT; District Magistrate / Collector (at district level); mutual-aid partners (state/district agencies, NDRF, SDMA).

Government-specific certifications: NDMA-aligned disaster-management certifications; NCIIPC-aligned CII-protection certifications; CERT-In empanelled auditor certifications; sector-specific.

Investment range: variable; often grant-funded or budget-line funded.

Maturity Model

The five-level maturity model is the self-assessment framework. Use it to baseline your 7.2 system and to set advancement targets.

Level 1, Initial / CV-driven (typical of firms without a BCMS or in early ISO 22301 engagement)

• Competence is assumed from the CV; training is a one-off induction; no Competence Matrix; the Evidence Record is an HR file with attendance sheets; no BCM Role Taxonomy; no TNA; no TDP; no Effectiveness Evaluation; no re-validation; no Key-Person Risk Register; no Supplier Competence Map.
• Typical year-1 cost of staying at L1: ₹1–3 lakh (mostly internal effort). Cost of a finding: high, an L1 system is a Stage 1 major non-conformity.
• Advance to L2: charter the system, publish the Role Taxonomy v1, build the Matrix, write the TNA, open the Evidence Records (Sections 7, 11, 17).

Level 2, Managed / spreadsheet-based (typical of newly certified growing companies)

• Competence Management Policy and Procedure exist; the BCM Role Taxonomy covers the BCM team and the CMT; the Competence Matrix exists in a spreadsheet with annual updates; the TNA exists; the TDP is partially executed; the Evidence Records exist but are not fully controlled; Effectiveness Evaluation is Level 1 only (reaction); re-validation is ad-hoc; the Key-Person Risk Register exists but is incomplete; the Supplier Competence Map names organisations but not individuals.
• Typical year-1 cost of staying at L2: ₹8–20 lakh. Audit risk: moderate, minor non-conformities likely.
• Advance to L3: migrate to the LMS / BCM-GRC platform; capture Level 3 (Behaviour) evidence; complete the Key-Person Risk Register; populate the Supplier Competence Map with named individuals.

Level 3, Defined / system-based (typical of mature mid-market and smaller enterprise)

• Full Competence Management Policy and Procedure operated day-to-day; the BCM Role Taxonomy covers all BCM-relevant roles including supplier roles; the Competence Matrix lives in the LMS/GRC platform with trigger-based updates; the TNA is gap-driven and prioritised; the TDP is fully executed with completion evidence; the Evidence Records are controlled per Clause 7.5; Effectiveness Evaluation is Level 3 for material interventions; re-validation is scheduled (annual for Tier 1); the Key-Person Risk Register is complete; the Supplier Competence Map names individuals with currency tracking; internal audit (Clause 9.2) tests the system annually.
• Typical year cost of staying at L3: ₹30–80 lakh. Audit risk: low.
• Advance to L4: add Level 4 (Results) effectiveness measurement; integrate the exercise-evaluator ratings bidirectionally with the Matrix; add skills-assessment platform; benchmark against sector peers.

Level 4, Quantitatively managed / outcomes-based (typical of sector-leading enterprise)

• The L3 system plus: Level 4 (Results) effectiveness measured for material interventions (RTO achievement, audit-finding reduction, incident-response time reduction); bidirectional integration between the exercise platform and the Matrix (exercise performance updates the Matrix in real time); skills-assessment platform with behavioural assessment; sector benchmarking against peer firms; the competence KPIs reported on the board dashboard; advanced certifications (MBCI, MBCP, CISSP-ISSMP, CRISC) for senior BCM leaders; mature cross-training pipelines for every Tier 1 role.
• Typical year cost of staying at L4: ₹80 lakh–₹2 crore. Audit risk: minimal.
• Advance to L5: add AI-driven personalisation, adaptive learning paths, and external benchmarking.

Level 5, Optimising / sector-leading (rare; the strategic differentiator)

• The L4 system plus: AI-driven personalisation of learning paths based on the Matrix and the exercise performance; adaptive-learning platforms; continuous external benchmarking against sector peers; competence as a customer-facing differentiator (the firm's BCM competence is in the sales proposition); integrated with enterprise human-capital reporting (ISO 30414) at the board level; the system generates its own improvement actions through analytics; the firm is recognised (by its regulator, its customers, its peers) as a sector leader on operational-resilience competence.
• Typical year cost of staying at L5: ₹80 lakh–₹3 crore. Strategic value: high, the system is a differentiator, not a cost centre.

Maturity advancement investment (typical India mid-market 2025–2026)

These figures are category-level mid-market India ranges observed in 2025–2026; verify against current pricing before procurement.

Self-assessment scorecard

Score each dimension 0 (absent) to 5 (sector-leading):

1. Competence Management Policy and Procedure, operated and reviewed.
2. BCM Role Taxonomy, complete, current, tier-assigned, supplier-inclusive.
3. Competence Profiles, per role, five-dimension, role-specific.
4. Competence Matrix, populated, current, triangulated, trigger-updated.
5. Training Needs Analysis, gap-driven, prioritised, action-typed.
6. Training and Development Plan, dated, budgeted, owner-assigned, executed.
7. Effectiveness Evaluation, Level 3+ for material interventions.
8. Competence Evidence Records, controlled per Clause 7.5, complete per role-holder.
9. Periodic Re-validation, scheduled (Tier 1 annual), on-trigger.
10. Key-Person Risk Register, complete; alternates Level 2+; succession plans.
11. Supplier Competence Map, names individuals; currency tracked; right-of-audit exercised.
12. Internal Audit testing, annual; findings closed.
13. Management Review reporting, competence portfolio on the agenda every cycle.
14. Continual Improvement, advancement targets set and executed year-on-year.
15. Sector Benchmarking, external comparison; learning from peers.

Scoring: 0–30 = L1; 31–50 = L2; 51–65 = L3; 66–73 = L4; 74–75 = L5. Use the scorecard quarterly; track the trend.

Emerging Trends

The 7.2 system is not static. Six trends are reshaping BCM competence in India and globally in 2025–2026.

Simulation-led development

The shift from classroom-dominant to simulation-dominant competence development. The most advanced firms now run quarterly simulations (tabletop, command-post, or full-scale) for Tier 1 roles, with the simulation performance as the primary evidence channel. The drivers: (a) simulations produce Level 3 (Behaviour) and Level 4 (Results) evidence directly, where classrooms produce only Level 1 and Level 2; (b) simulations surface gaps that classrooms hide, the CMT that "knew" the plan but could not execute it; (c) simulation providers are now affordable for growing firms (₹5–25 lakh per major simulation). The CMT-crisis-leadership programme described in the Sharda Logistics case (Section 15) is the canonical mid-market pattern.

AI-augmented competence systems

AI tools are amplifying the BCM Manager, drafting plan documents, generating exercise scenarios, summarising exercise notes, surfacing regulatory changes, generating draft Evidence Records, and personalising learning paths. The mature posture in 2025–2026 is to use AI to free the BCM Manager's time for the human-judgement work (board engagement, regulator engagement, crisis-room leadership), not to replace it. AI-deference, where the BCMS treats the AI's output as the answer, is non-conformant on 7.2.

Regulator-driven competence expectations

The 2023–2025 wave of Indian regulation (RBI MD IT Governance, SEBI CSCRF, IRDAI Guidelines, CERT-In Directions, DPDP Act) has tightened the competence expectations on regulated firms. The direction is consistent: regulators expect demonstrable, individual-level competence for BCM-critical roles, not organisation-level certifications. The trend will continue with the DPDP Rules 2025 and the rolling implementation of the RBI MD and SEBI CSCRF through 2025–2026.

Skills-based hiring for BCM roles

The shift from credentials-based to skills-based hiring in BCM. The mature firm still values the BCI CBCI / DRI CBCP / CISSP certifications but supplements them with skills-based assessment, situational-judgement tests, work-sample exercises, behavioural interviews. The driver: the supply of certified BCM professionals in India is structurally thin (Section 3.3); skills-based assessment widens the talent pool without compromising the competence floor.

Cross-framework integration

The shift from framework-by-framework competence evidence to integrated evidence that satisfies multiple frameworks at once. The integrated ISMS+BCMS+QMS+SOC 2 audit is now common for IT-ITeS firms; the same Competence Matrix satisfies all four. The DORA Art 5(4) management-body training expectation (for firms serving EU financial entities) and the APRA CPS 230 para 41 expectation (for firms with Australian exposure) are extending the integration. The mature firm runs one competence system, not four.

Micro-learning and behavioural nudges

The shift from quarterly-day-long training to continuous micro-learning and behavioural nudges. The mature firm delivers a 5-minute BCM micro-learning module to the BCM team every week, with a behavioural-nudge prompt (e.g., "this week, when you chair a meeting, practice delegation"). The evidence of competence accrues through the LMS's micro-assessment results. The driver: classroom training decays fast (industry studies suggest 60–80% of classroom learning is forgotten within 30 days without reinforcement); micro-learning with reinforcement retains.

Sector-specific developments to watch (2025–2026)

• BFSI. The RBI's continued tightening of board-IT competence expectations; the rolling implementation of SEBI CSCRF through 2025–2026; the IRDAI's tightening of CISO qualifications.
• Healthcare. The NABH alignment with DPDP for patient-data availability; the spread of clinical-continuity credentials beyond tertiary hospitals.
• IT-ITeS. The maturing of DORA for Indian IT-ITeS serving EU financial entities; the rise of customer-driven competence audits as a sales gate.
• Manufacturing. The integration of process-safety competence with BCM competence (especially post-LG Polymers); the OT/ICS security competence wave (NIST SP 800-82 Rev 3 alignment).
• Government. The NCIIPC's evolving expectations on CII operators; the NDMA's continuing rollout of state and district DMPs.

References and Further Reading

Standards (citable; verify current edition before quoting year)

• ISO 22301:2019 / Amd 1:2024, Security and resilience, Business continuity management systems, Requirements.
• ISO 22313:2020, Guidance on the use of ISO 22301.
• ISO 22300:2021, Security and resilience, Vocabulary (verify whether a 2025 edition has published).
• ISO/TS 22317:2021, Guidelines for business impact analysis.
• ISO/TS 22318:2021, Supply chain continuity.
• ISO/TS 22330:2018, Guidelines for people resilience.
• ISO/TS 22331:2018, Guidelines for business continuity strategy. (Note: ISO catalogue page iso.org/standard/50068.html lists this as ISO/TS 22331:2018; year requires confirmation.)
• ISO 22316:2017, Organizational resilience.
• ISO/IEC 27001:2022, Information security management systems, Requirements (Clause 7.2; A.5.10).
• ISO/IEC 27006:2015 / Amd 1:2020 / Amd 2:2024, Requirements for bodies providing audit and certification of ISMS.
• ISO 9001:2015, Quality management systems (Clause 7.2).
• ISO 14001:2015, Environmental management systems (Clause 7.2).
• ISO 45001:2018, Occupational health and safety management systems (Clause 7.2).
• ISO/IEC 20000-1:2018, IT service management (Clause 7.2).
• ISO 30414:2018, Human capital reporting.
• ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems.

Frameworks and regulations (citable)

• NIST SP 800-34 Rev 1 (May 2010), Contingency Planning Guide for Federal Information Systems.
• NIST SP 800-160 Vol 1 (Nov 2016) + Vol 2 Rev 1 (Sep 2021), Systems Security Engineering / Cyber Resilience.
• NIST SP 800-181 Rev 1, Workforce Framework for Cybersecurity (NICE Framework).
• NIST CSF 2.0 (Feb 2024), Cybersecurity Framework (Govern function).
• FFIEC IT Examination Handbook, Business Continuity Management Booklet (Nov 2019).
• FEMA FCD-1 (17 Jan 2017) + FCD-2 (13 Jun 2017), Continuity of Operations.
• DORA, Regulation (EU) 2022/2554 (applies 17 Jan 2025), Art 5(4), Art 13, Art 19.
• APRA CPS 230 (eff 1 Jul 2025), paras 16, 41, 47.
• MAS TRM Guidelines, Singapore.
• HKMA TM-G-2 / SA-2, Hong Kong.
• SOC 2 (TSP 2017, with 2022 points of focus), CC1.1, CC2.2, CC3.1, CC7.4.
• COBIT 2019, EDM02, APO07, APO08.

Indian regulations and instruments (citable)

• RBI Master Direction, IT Governance, Risk, Controls and Assurance Practices (7 Nov 2023, eff 1 Apr 2024).
• RBI Cyber Security Framework in Banks (2 Jun 2016).
• RBI Complete Cyber Security Framework for UCBs (31 Dec 2019).
• RBI Master Direction, Outsourcing of IT Services (10 Apr 2023).
• SEBI Cybersecurity and Cyber Resilience Framework (CSCRF), SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 (20 Aug 2024).
• SEBI BCP/DR for MIIs, SEBI/HO/MRD1/DTCS/CIR/P/2021/33 (22 Mar 2021), with 12 Sep 2024 modifications.
• IRDAI Information and Cyber Security Guidelines, 2023 (24 Apr 2023).
• CERT-In Directions, No. 20(3)/2022-CERT-In (28 Apr 2022).
• DPDP Act 2023 (Act 22 of 2023) + DPDP Rules 2025.
• Companies Act 2013, §134(3)(n), §177; SEBI LODR Regulation 21.
• Disaster Management Act 2005; NDMA Chemical Disaster Guidelines 2007; NDMA Guidelines for Preparation of DMPs.
• IT Act 2000, §43, §65, §66, §70, §70A, §70B.

Recognised professional certifications (citable; verify current syllabi and renewal rules)

• BCI, Certificate of the BCI (CBCI); member grades AMBCI, MBCI, FBCI.
• DRI International, ABCP, CFCP, CBCP, CBCV, CFCM, MBCP.
• ISACA, CISA, CISM, CRISC, CGEIT.
• ISC2, CISSP, CCSP, HCISPP.
• EC-Council, CEH, CHFI.
• NCSIH, clinical-continuity credential (NABH-aligned).
• NISM / NCFM, capital-markets certifications.
• NEBOSH / IOSH, EHS.
• GICSP, OT/ICS security.
• ITIL 4, PRINCE2, PMP, TOGAF, adjacent.

Citable data and incident anchors

• BCI Horizon Scan 2025 and 2024, the most-citable BCM industry datasets.
• AIIMS Delhi ransomware (23 Nov 2022), peer-reviewed IJIM illustrative scenario.
• Cognizant Maze ransomware (18–20 Apr 2020), SEC-filed 10-Q/K ($50–70M Q2 2020 impact).
• LG Polymers styrene leak (7 May 2020, Visakhapatnam), NGT interim penalty ₹50 crore; LG Chem relief package ₹730 crore.
• Maruti Suzuki Manesar violence and fire (18 Jul 2012), ~₹1,400 crore lockout loss.
• Akasa Air pilot-exodus (2023), ~₹3 crore per day loss at peak; people-resilience lesson.
• IndiGo 19 Jul 2024 (CrowdStrike), 283 flights cancelled; contrast with Akasa (zero cancellations same day).
• Chennai floods (Dec 2015), Cognizant official statement (BCP invoked, guidance reaffirmed at ≥$12.41bn); the canonical BC-success anchor.
• HDFC RBI action (2 Dec 2020), repeated digital outages led to a regulatory bar on new digital products; board-level governance failure.

Reference books (used as inspiration during research; not named in this output, per the IP-and-sourcing rules that govern this series)

The authoring team consulted a range of BCM/DR reference texts during research. Per the IP-and-sourcing rules that govern this series, those books and their authors are not named in this output; the principles drawn from them are restated in our own words throughout the guide. Frameworks, regulations and recognised certifications mapped TO (ISO 22301, ISO 27001, NIST SP 800-34, FFIEC, DORA, APRA CPS 230, MAS TRM, HKMA TM-G-2, RBI, SEBI, IRDAI, CERT-In, DPDP, Companies Act, NDMA, IT Act; BCI, DRI, ISACA, ISC2 certifications) ARE cited by their marquee IDs.