A business continuity management system for Qatari banks, telcos and public-sector bodies that runs NIA continuity evidence and an ISO 22301 BCMS from one dataset. Structured plans, verified call-tree drills and PDF exports for auditors.
Qatar’s continuity obligations arrive from two directions at once — NIA’s business continuity expectations and a privacy law with a hard notification deadline. One dataset makes both easier to evidence.
Qatari bank
Produce NIA continuity evidence and an ISO 22301 BCMS without maintaining two parallel programmes and two sets of documents.
Telco / energy
Prove that recovery plans work across a large, distributed workforce, and that the people named in them can actually be reached.
Public sector
Move continuity off SharePoint and Excel into something an information security committee will approve, with data isolation you can describe in one sentence.
Ask every vendor on your shortlist to show the same four things with your data.
Every customer's data sits in its own Postgres schema, and each request is scoped to that schema inside its database transaction. Isolation does not depend on a tenant filter being present in every query. Ask each vendor how theirs separates your data from other customers'.
The maximum tolerable period of disruption is calculated from the impact-over-time matrix and each category's threshold, so it moves when the analysis moves. Consistency checks flag an RTO that exceeds the MTPD, or one faster than the applications and vendors the process depends on.
When a relay reports reaching someone, that person is asked separately to confirm it. Each contact ends verified, contradicted or expired, so a drill becomes evidence and a stale contact detail shows up before an incident rather than during it.
The annual test programme tracks which of five scenario themes (IT system loss, cyber, critical vendor, staff and workspace) have been exercised. Passing and partial tests count; failed ones do not. Covered versus required is visible all year, not reconstructed the week before a review.
An honest scope statement is more useful than a compliance claim.
NIA — continuity and incidents
Continuity planning, testing and incident evidence in NIA-shaped form. NIA is a broad information-security framework; BCMStack covers its continuity side, not its network or application domains.
ISO 22301 — the BCMS
The operational lifecycle: BIA, risk, plans with phased recovery (respond, recover, restore), activation records, exercises with after-action reviews, and improvement actions.
PDPPL — the 72-hour duty
Incidents record whether personal data is involved and can be classified high automatically. There is no PDPPL-specific clock yet, so track the 72-hour deadline explicitly.
Pricing depends on the number of users, the modules in scope and any hosting requirements. Tell us those and we’ll send a quote.
Request a quoteThe order most teams follow. How long it takes depends on how much of your BIA and plan content already exists.
Step 1
Step 2
Step 3
Qatari organisations subject to the NIA framework need business continuity software that produces NIA-shaped continuity evidence alongside a working ISO 22301 BCMS, rather than a generic BCM tool. BCMStack is built for that overlap: plan essentials such as activation criteria and recovery objectives are separate fields rather than free text, the business impact analysis derives the MTPD from the impact-over-time matrix instead of asking someone to type a number, every plan activation is logged, and call-tree drills ask each person reached to confirm it themselves rather than trusting the relay's report. Each customer's data sits in its own database schema.
BCMStack covers the business continuity and incident-management side of NIA — the continuity planning, testing and incident evidence — and pairs it with an ISO 22301 BCMS in the same dataset, so you are not maintaining two parallel programmes. NIA is a broader information-security framework; BCMStack does not cover its other domains, so plan to run it alongside the tools you use for those.
Incidents record whether personal data is involved, and an incident involving personal data can be classified as high automatically. The notification clock in BCMStack today is built for SAMA, so there is no separate PDPPL clock for the 72-hour duty to notify the National Data Privacy Office: track that deadline explicitly. BCMStack keeps the incident record and status history; it does not file notifications for you.
Each customer's data sits in its own Postgres schema, so isolation does not depend on a tenant filter in every query. Hosting is in the EU by default. In-region hosting in Qatar is not available today; if residency is a contractual or regulatory requirement for you, raise it before you sign.
The interface and exports are in English. Call-tree messages can be written and sent in both Arabic and English. If a bilingual interface is a procurement condition for you, tell us during evaluation.
Yes. Processes, applications, vendors and locations are entered in the platform — there is no bulk import yet, so plan for that work — and plans are rebuilt as structured records rather than uploaded documents. The change most teams notice is that evidence stops being assembled by hand the week before an audit, because tests, plans and improvement actions already reference each other.
The right business continuity system for a Qatari organisation is one that produces NIA-shaped continuity evidence and a working ISO 22301 programme from the same dataset, rather than two parallel efforts. Test it with one of your own critical services: run the BIA, approve the plan, run a test and a call-tree drill, then ask for the evidence pack. BCMStack is a business continuity management system (BCMS) that keeps the BIA, plans, tests, crises, incidents and call trees in one dataset for Qatari banks, telcos and public-sector bodies.
No — they are unrelated vendors and categories, though the similar spelling confuses search results. BMC Software is an IT service management and operations vendor. BCM software means business continuity management software: business impact analysis, continuity and recovery plans, exercise programmes, crisis management and regulator-shaped reporting. Organisations evaluating BCM software Qatar's banks, telcos and public-sector bodies actually use — meaning NIA-aligned continuity evidence alongside a working ISO 22301 BCMS — are looking for the second category. BCMStack is BCM software in that sense; it is not an ITSM platform.
Tell us your organisation, which frameworks you answer to, and where your continuity workflow lives today. We’ll show you the platform working against a representative Qatari dataset and answer the questions your information security committee will ask.
Request a demoWe aim to respond within one business day.