A business continuity management system for KSA banks, insurers and fintechs that maps the SAMA BCM Framework and ISO 22301 to one workspace. Structured plans, SAMA notification clocks and PDF exports for examiners, with each customer’s data in its own database schema.
We work with a focused group of SAMA-regulated organisations that want a platform built around their regulator, not retrofitted.
KSA bank
Run the SAMA programme from one dataset instead of Word plans and Excel BIAs, so the evidence for a critical service comes from linked records rather than a week of assembly.
Insurer / fintech
Move BCM out of SharePoint and Excel before the next SAMA review, onto a platform your information security committee can assess.
Internal audit
Test the continuity programme yourself, without asking the BCM team for screenshots.
Ask every vendor on your shortlist to show the same four things with your data.
Every customer's data sits in its own Postgres schema, and each request is scoped to that schema inside its database transaction. Isolation does not depend on a tenant filter being present in every query. Ask each vendor how theirs separates your data from other customers'.
Purpose, scope, activation criteria and authority, deactivation criteria, classification, and target RTO and RPO are separate fields on every plan, not paragraphs in a document. Approval keeps a snapshot of each version, and a consistency check flags a plan whose target RTO is slower than the BIA of a process it covers.
Each time a plan is invoked, BCMStack records when and by whom, the trigger, the crisis it belongs to, the outcome and the improvement actions it raised. Deactivation closes the same record. It shows a plan has been used, not only written.
Classifying an incident as medium or high starts a notification clock, 4 or 24 hours by default and configurable. Owners are alerted at half-time, 15 minutes before the deadline and at breach, then hourly. The notification is drafted, approved and submitted with its reference number, and the incident cannot close while it is outstanding.
Our buyer’s guide for SAMA-regulated institutions sets out ten criteria, the questions to ask each vendor and a proof-of-concept script to run with your own data. For a side-by-side view, see BCMStack compared with:
Pricing depends on the number of users, the modules in scope and any hosting requirements. Tell us those and we’ll send a quote.
Request a quoteThe order most teams follow. How long it takes depends on how much of your BIA and plan content already exists.
Step 1
Step 2
Step 3
Step 4
SAMA-regulated organisations in Saudi Arabia need business continuity software that produces evidence against the SAMA BCM Framework, not just a generic BCM tool. BCMStack is built for this: the business impact analysis derives the MTPD from the impact-over-time matrix and flags recovery objectives that contradict it, plans are structured records with approval and an activation log, incidents classified as medium or high start a SAMA notification clock with escalating alerts, and the annual test programme tracks coverage across five scenario themes. Each customer's data sits in its own database schema.
Each customer's data sits in its own Postgres schema, so isolation does not depend on a tenant filter in every query. Hosting is in the EU by default. In-region hosting in Saudi Arabia is not available today.
BCMStack does not offer hosting inside Saudi Arabia today. If KSA residency is a contractual or regulatory requirement for you, raise it with us before you sign, and check the arrangement against SAMA's outsourcing rules and your own cloud and data-classification policy.
The interface is in English. Call-tree messages can be written and sent in both Arabic and English.
BCMStack is quoted per organisation, based on the number of users, the modules in scope and any hosting requirements. Ask for a quote through the contact page.
Yes, whether you are moving from an older BCM platform or from SharePoint and Excel. Processes, applications, vendors and locations are entered in the platform; there is no bulk import yet, so plan for that work and talk to us about the size of your registers. Most teams start with one critical service, from BIA to a tested plan, and expand from there.
The right business continuity system for a Saudi organisation is one that produces SAMA-shaped evidence from linked records rather than documents you assemble by hand. Test it with one of your own critical services: run the BIA, write and approve the plan, record a test and a DR test, raise a reportable incident, then ask the platform for the evidence pack. BCMStack is a business continuity management system (BCMS) built to ISO 22301 with the SAMA BCM Framework in mind, and keeps the BIA, plans, tests, incidents and SAMA notifications in one dataset for banks, insurers, finance companies, fintechs and payment service providers in Saudi Arabia.
No — they are unrelated, and the similar spelling causes real confusion in search results. BMC Software is a global IT service management and operations vendor. BCM software means business continuity management software: business impact analysis, continuity and recovery plans, exercise programmes, crisis management and regulator-shaped reporting. Organisations looking for BCM software Saudi Arabia regulators will accept — meaning evidence mapped to the SAMA BCM Framework and ISO 22301 — are looking for the second category. BCMStack is BCM software in that sense; it is not an ITSM platform and does not replace one.
Tell us your organisation, your regulator, and where your BCM workflow lives today. We’ll show you the platform working against a representative SAMA dataset and answer the questions your information security committee will ask.
Request a demoWe aim to respond within one business day.