# BCMStack

> BCMStack is a multi-tenant Business Continuity Management platform built for SAMA-regulated banks, insurers and fintechs across the GCC. Native ISO 22301 §8.4.4 fields, §8.4.5 phased recovery, §8.5 activation log. Schema-per-tenant data isolation. Modern stack (Next.js 15 / RSC / tRPC / Drizzle / Postgres).

## Frameworks

- [SAMA BCM Framework](https://bcmstack.com/frameworks/sama-bcm): Complete guide to Saudi Central Bank's BCM Framework — five pillars, what auditors check, ISO 22301 overlap, 12-month compliance roadmap.
- [ISO 22301:2019](https://bcmstack.com/frameworks/iso-22301): Clause-by-clause walkthrough of the international BCMS standard, certification path, common gaps, platform mapping.
- [NCA ECC](https://bcmstack.com/frameworks/nca-ecc): Saudi National Cybersecurity Authority's Essential Cybersecurity Controls — BCMStack covers the Cybersecurity Resilience domain natively.
- [Qatar NIA](https://bcmstack.com/frameworks/nia): Qatar's National Information Assurance Framework — BCMStack covers the Operational Continuity and Incident Management domains.

## Products

- [BCP module](https://bcmstack.com/products/bcp): Business Continuity Plans with native ISO 22301 §8.4.4 fields, §8.4.5 phased recovery (respond/recover/restore), and §8.5 activation log as a first-class feature.
- [BIA module](https://bcmstack.com/products/bia): Business Impact Analysis with configurable impact matrix per tenant, impact-over-time analysis, RTO/RPO/MTPD calculation, five-dimension dependency mapping.
- [Risk Management](https://bcmstack.com/products/risk): Risk register with polymorphic targets (process · vendor · application · location), inherent + residual scoring, scenario library, critical-asset linkage.
- [Crisis Management](https://bcmstack.com/products/crisis): Auto-coded crisis events (CR-YYYY-NNN) with auto-numbered action items (A1, A2…), BCP activation linkage, structured impact tracking, reopen-after-close support.
- [Exercise Programme](https://bcmstack.com/products/exercises): ISO 22398-aligned exercise programme with MSEL injects, evaluator observations, AAR lifecycle (draft → approved), SAMA mandatory coverage rollup.
- [Reporting + PDF](https://bcmstack.com/products/reporting): Cross-module dashboard with live tRPC rollups across BIA, BCP, Exercises, Crisis, Risk, Improvement Actions. Branded PDF exports in ISO 22301-shaped sections.

## Compare

- [BCMStack vs Castellan](https://bcmstack.com/compare/castellan): Schema-per-tenant vs row-level. §8.4.4 native vs free-text. $30-60K vs $80-120K.
- [BCMStack vs Fusion](https://bcmstack.com/compare/fusion): Without paying Salesforce twice. Native §8.4.4 vs Salesforce custom fields. $30-60K vs $100-250K.
- [BCMStack vs Origami Risk](https://bcmstack.com/compare/origami): BCM-first vs broader GRC. Pre-configured vs partner-led configuration.
- [BCMStack vs 6clicks](https://bcmstack.com/compare/6clicks): BCM specialist vs broad GRC platform. ISO 22398 + SAMA coverage vs Hailey AI + content marketplace.
- [BCMStack vs spreadsheets](https://bcmstack.com/compare/spreadsheets): When SharePoint + Excel works, when it breaks, and the migration path.

## Solutions

- [BCM software for KSA](https://bcmstack.com/solutions/bcm-software-ksa): The platform KSA banks, insurers and fintechs use to map the full SAMA BCM Framework and ISO 22301 to one workspace.

## Key facts

- **Target market:** SAMA-regulated organisations across the GCC — banks, insurers, finance companies, fintechs, payment service providers.
- **Pricing band:** $30K–$60K annual contract value for mid-market, published openly. No platform-seat tax, no Salesforce dependency.
- **Architecture:** Schema-per-tenant on Postgres (Neon). Each customer gets a dedicated schema accessed via SET LOCAL search_path. Cross-tenant access is impossible by construction.
- **Stack:** Next.js 15 App Router, React 19, RSC, tRPC v11, Drizzle ORM, Better Auth, Cloudflare R2, @react-pdf/renderer.
- **Frameworks pre-mapped:** SAMA BCM Framework, ISO 22301:2019, ISO 22398:2013. NCA ECC and Qatar NIA covered for BCM-relevant controls only.
- **Differentiators:** §8.4.4 native fields (peers store as free-text). §8.4.5 phased recovery (peers store flat list). §8.5 activation log as first-class. SAMA mandatory coverage rollup from passing exercises only. Schema-per-tenant data isolation.
- **Implementation:** 14 days from signed contract to first BIA approved, self-serve. Castellan typically 4-8 weeks consult-led; Fusion 4-8 weeks Salesforce-config-led; Origami 3-6 months partner-led.

## Optional

- [Homepage](https://bcmstack.com/): Marketing landing page with full lifecycle overview.
- [Sitemap](https://bcmstack.com/sitemap.xml): Machine-readable sitemap of all public pages.