LuxGapBusiness continuity

A continuity plan that holds up on the day you need it.

BCMS / BCP as-a-Service: a business continuity management system compliant with ISO 22301, aligned with NIS2 and DORA, continuously maintained and accessible in all circumstances.

Request a demonstration Explore the console

Console dashboard: plan drafting progress, next actions and BCP maturity of a demonstration accounting firm — Fictitious demonstration data.

24/7Portal accessThe plan remains accessible
1+/yearSimulation exerciseFull test of the arrangements
100%Evidence maintainedAudit file always up to date
3Frameworks coveredISO 22301, NIS2, DORA

The problem

A plan filed away in a shared folder is of no use when the day comes.

Organisations hit by a major disruption find out too late that their plan has gone out of date. And if it lives on an internal server, a ransomware attack makes it unavailable at the very moment it was needed.

Contacts that have changed

Managers who have left, wrong numbers, deputies never appointed: no one knows whom to call while the incident unfolds.

Timeframes that no longer hold

IT dependencies have changed, the stated recovery times no longer bear any relation to reality, and the annual exercise keeps being postponed.

Obligations that are tightening

NIS2 lists business continuity and crisis management among the expected measures; DORA requires testing in the financial sector. A binder proves nothing.

The continuity portal

Your entire continuity system, in a console that opens when it counts

Each step prepares the next: the impact analysis feeds the strategies, playbooks and exercises. Nothing is entered twice.

Impact analysis

The BIA, service by service

Each activity is assessed: criticality, maximum tolerable period of disruption, recovery objectives, minimum service level and vital records.

MTPD, RTO and RPO for every critical service
Import your existing BIA sheets from Excel or Markdown
Risks and strategies derived from the analysis, without starting from a blank page

BIA sheet for the Accounts Production service: MTPD of five working days, RTO of 24 hours, RPO of 4 hours, minimum service level — Fictitious demonstration data.

Emergency playbooks

One action card per scenario

Fire, outage, supplier failure, cyberattack: each scenario has its own card, with the trigger, the actions for the first few minutes and the people to contact.

Fourteen ready-to-use scenarios, tailored to your plan
People, disasters, IT, suppliers, cyber
The date of the last test, so you know what has never been exercised

List of the fourteen emergency playbooks grouped by family: people, disaster, IT and networks, suppliers, cyber — Fictitious demonstration data.

Tests and exercises

An untested plan is merely an assumption

The console schedules the exercise programme, keeps track of the ISO 22301 annual deadline and shows the parts of the plan that have never been put to the test.

Tabletop exercises, notification tests, scenario simulations
Exercise report and corrective action plan
A dated record, usable in an audit

Tests and exercises screen: last exercise, annual deadline, calendar for the year and recommended exercises — Fictitious demonstration data.

Crisis mode

The day everything stops, the console becomes your crisis unit

The playbook unfolds action by action, every decision is recorded in a time-stamped log, responders are notified in one go and the incident is opened in the register automatically.

Crisis unit active during a ransomware attack: management indicators, playbook actions ticked off and time-stamped crisis log — Fictitious demonstration data.

Exercise or real crisis

A unit opened as an exercise is flagged as such and sends no alerts. Nobody gets woken up for a drill.

Time-stamped log

Time, author, action, decision: the memory of the crisis while it lasts, and the evidence afterwards, for an auditor, an insurer or an authority.

Legal deadlines in sight

The incident register records the classifications and relevant deadlines, such as the GDPR's 72 hours, so that the question ‘is this notifiable?’ is asked early.

Crisis messaging

When the company's email goes down, the team keeps talking

A cyberattack often takes down email and telephony along with the servers. The console has its own built-in messaging, hosted outside your information system: one channel for everyone, groups for the crisis unit, from a computer or a personal phone.

Console messaging during a ransomware attack: an accounting firm's general channel, Crisis unit, IT team and Management groups, and messages from the LuxGap consultant — Fictitious demonstration data.

A general channel and groups

Every account in your workspace is in the general channel; a handful of people share a group that you put together, where newcomers can read back through the history.

Your LuxGap consultant on board

The LuxGap team supporting you reads and replies in the general channel, with its messages flagged as such. Groups remain restricted to their own members.

Encrypted, erasable

Messages are encrypted in the database. A password pasted by mistake can be erased in a single action, for good.

Accessible in all circumstances

Independent of your information system

The console is hosted by LuxGap, in France, with OVHcloud, within the European Union. If your servers go down, your plan is still there.

Offline crisis pack

The plan, playbooks and directory in a single PDF, to keep on a computer or on paper: the only version you can consult if the entire network is down.

Access for your auditor

A read-only link, protected by an access code, that expires on the date you choose and can be revoked in one click. Neither the crisis log nor the incidents are exposed.

Segregated and logged workspaces

Each client in its own workspace, minimal roles (manager, contributor, reader) and an audit log of every sensitive change.

Our offer

BCMS as-a-Service, all inclusive

Implementation, maintenance, audit evidence and annual exercises, in a monthly subscription aligned with ISO 22301, NIS2 and DORA.

Initial implementation

Scoping: boundaries, interested parties, applicable requirements
BIA and risk analysis, dependency mapping
RTO, RPO and MTPD for each critical process
Crisis, communication, continuity and IT recovery plans

Operation and ongoing maintenance

PDCA cycle: objectives, indicators, reviews, corrective actions
Portal updated with every change, versions tracked
Staff awareness and training, with certificates
NIS2 and DORA regulatory monitoring

Exercises and evidence

Annual simulation and crisis communication exercise
Exercise report, lessons learned, action plan
ISO 22301 internal audit and management review
Audit file ready for certification, should you wish

Prefer to write the plan yourselves? The Self-service option opens the console to your teams, guided by the questions in each section.

Compliance

One system, three frameworks covered

ISO 22301 provides the system; NIS2 and DORA set the obligations. The console links each requirement to your plan, and only counts it as covered once its evidence exists.

ISO 22301	NIS2: risk management	DORA: ICT continuity	Practical benefit
8.2BIA and risks	Business continuity, crisis management, risk assessment	BIA and ICT disruption scenarios	A single analysis for all three frameworks
8.3Strategies	Backups, recovery, resilience	ICT plans, backup and restoration	Strategies sized from end to end
8.4Plans	Crisis management and operational continuity	Response, recovery, ICT third-party providers	Plans that can be executed, not just written
8.5Exercises	Capability demonstrable through testing	Periodic testing and proof of effectiveness	Evidence that supervisors can use
9–10Audit	Governance and proportionate measures	Traceability, internal control, remediation	A complete, up-to-date audit file

ISO 22301:2019NIS2 · Directive (EU) 2022/2555DORA · Regulation (EU) 2022/2554GDPRNIST CSF 2.0

Compliance map: requirements drafted and requirements evidenced out of 76, and the evidence needed to close the gap — Fictitious demonstration data. Which of the frameworks cited apply depends on your activities.

Questions

The questions we are asked

Who writes the plan: you or us?

Two options. With Managed by LuxGap, our consultants write the plan with you and you approve it section by section. With Self-service, your teams write it themselves, guided by the questions in each section and by the drafting assistant.

We already have an impact analysis in Excel. Do we have to re-enter everything?

No. Your BIA sheets can be imported from Excel or Markdown, including in the form of a tabular register. Critical processes, MTPD, RTO, RPO and dependencies are extracted, and the risks and strategies are then derived from them.

Can we run an exercise without alerting the whole company?

Yes. A crisis unit opened in exercise mode is flagged as such and sends no notifications. The exercise log is kept: it is the evidence that the exercise took place, and the basis for its lessons-learned review.

Can our auditor or our DPO view the plan?

Yes, through a read-only sharing link: it carries an access code, expires on the date you choose and can be revoked in one click. It does not expose the library, the crisis log, the incident register or the audit log.

Which frameworks are covered?

ISO 22301:2019, NIS2, DORA, the GDPR and NIST CSF 2.0: 76 requirements in all. A requirement is only counted as covered if its evidence exists: a document uploaded, a BIA imported, an exercise carried out, the directory completed or training certified.

Where is our data hosted?

In France, with OVHcloud, within the European Union. The console is operated by LuxGap, in Luxembourg, under a contract governed by Luxembourg law. Each client workspace is segregated, and automated tests check this with every release.

In which languages is the console available?

In French and English: anyone can switch from one to the other in a single click. This page itself is available in six languages: French, English, German, Dutch, Luxembourgish and Portuguese.

Demonstration

See the console applied to your own activities

A demonstration takes around thirty minutes. We start from your sector and your actual activities, not from a test dataset.

Request a demonstration +352 621 583 116

Julien Winkin · julien.winkin@luxgap.com