Your organization is doing well and is at a stage to do even better! Enterprises with this score may not have all business critical processes identified, which is a crucial preparation step, and may only have some of those processes and associated procedures documented. Typically, an organization at this level has also identified the primary resources needed to perform and make crucial decisions but may still need to identify alternates. In addition, the business-critical systems and supporting applications may also have been identified but there is still a need to document and implement a back-up or fail-over plan. Because processes are not all documented, there are gaps in terms of agility in moving alternate people in, and training will not be comprehensive. Typically, the overall supply chain is understood, but there is not an end-to-end understanding of the customer experience impact of a supply chain disruption.
When it comes to change management, somewhat prepared businesses often do have programs in place to monitor and provide governance for processes, people, and systems but this might be largely a manual process. Additionally, Risks for business-critical processes may have been identified, and they may have mitigating controls in place, however they may be lacking the necessary re-assessment triggers to capture updates caused by a business continuity event or new regulatory requirements.
Lastly, somewhat prepared businesses may have key performance indicators (KPIs) in place to measure business critical processes, however if they are not aligned to strategic objectives and customer experience, it will be difficult to prioritize and implement emergency mode procedures.
As you move forward, it will also be important to ensure you are doing so using a process-centric business modeling methodology. Doing so will align the work you are doing to many other operational use-cases including compliance, digital transformation, and customer experience.
Download the Resiliency & Business Continuity Handbook