A data center goes down, a key supplier files for bankruptcy, or the only person with admin access to the production control system is on vacation. Such scenarios sound like exceptional cases. In practice, however, they demonstrate just how vulnerable companies are when no one knows exactly what their critical business processes depend on. Many organizations invest heavily in firewalls, encryption, and security awareness training, but in doing so, they overlook a fundamental question: What resources does the business actually need to keep running?
This is exactly where systematic resource planning comes into play. It is not merely a matter of workforce planning, but rather the foundation for business continuity, information security in accordance with ISO 27001, and true organizational resilience. This article explains what lies behind it, what requirements the standard sets, and how companies are addressing the issue in a practical way.
What Resource Planning Means in the Context of Information Security
In everyday life, the term is often reduced to a matter of capacity: Who is working on which project and when? In security and business continuity management, however, this view falls short. Here, resource planning means identifying and managing all the resources without which a critical process cannot function—and understanding how these resources are interconnected.
People, Technology, and Information
In resource planning, the workforce is usually the first factor to consider. What matters is not just the number of employees, but their knowledge and access permissions. A typical example from audits: Payroll processing depends on a single specialist whose expertise is not documented anywhere. Equally critical is information and communication technology—that is, servers, networks, cloud services, and line-of-business applications. Added to this are the information and data themselves—such as customer master data, design drawings, or contracts—whose availability and integrity directly impact operations.
Facilities, Service Providers, and Infrastructure
In manufacturing companies, the focus is on machinery and production equipment. If a specialized piece of equipment fails and there is no replacement available, the entire production line may come to a standstill. External service providers and suppliers are equally important: managed service providers, logistics partners, and manufacturers of intermediate products. Finally, buildings and infrastructure, as well as utility services such as energy, water, and telecommunications, form the foundation upon which everything else rests. Anyone who considers only individual categories will get an incomplete picture and underestimate their actual dependencies.
What Requirements Does ISO 27001 Place on Resource Management?
ISO 27001 does not address resource planning in a single, standalone chapter, but rather in several interconnected sections. Anyone implementing the standard will therefore inevitably encounter this topic.
Management System: Sections 6.1, 7.1, and 8.1
Chapter 7.1 requires the organization to identify and provide the resources necessary for the ISMS. Chapter 6.1 calls for the systematic identification and management of risks and opportunities—which is hardly possible without knowledge of the underlying resources. Finally, Chapter 8.1 addresses operational planning and control: processes should be planned in such a way that they reliably meet security requirements, even if parts of them are outsourced.
Controls from Appendix A: A.5.24, A.5.29, and A.5.30
Appendix A of ISO 27001 specifies the requirements in greater detail. Control A.5.24 addresses the planning and preparation for security incident management. A.5.29 requires that information security be maintained at an appropriate level even during an incident. A.5.30 requires ICT readiness for business continuity—that is, demonstrating that critical IT systems can be restored within defined timeframes. All three controls require that the organization know which systems, data, and individuals are essential to its core processes.
Why Resource Planning Strengthens a Company’s Resilience
The greatest benefit becomes apparent only in an emergency. Without a clear picture of interdependencies, companies usually discover their vulnerabilities the moment a disruption occurs—that is, precisely when there is no time left to think.
Identifying Single Points of Failure
A single point of failure is any resource whose failure would completely halt a critical process. This could be a single server without redundancy, a supplier with no alternative, or a person with exclusive knowledge. A real-world example: While preparing for TISAX, a medium-sized automotive supplier discovered that all of its customers’ delivery calls were routed through a single EDI interface managed by just one external service provider. It was only through structured resource planning that this risk became apparent, and the company was able to establish a second connection along with a contingency plan.
Improved recovery and well-informed decisions
Those who understand their resources can set realistic recovery times and tailor contingency plans accordingly. This strengthens operational resilience and transforms business continuity from a concept on paper into a living reality. At the same time, transparency enables risk-based decision-making: Budgets for redundancies, insurance, or additional training are allocated to areas where a failure would cause the most damage, rather than being distributed indiscriminately.
How to Put This Into Practice
Business Impact Analysis as the Starting Point for Resource Planning
The proven starting point for resource planning is the Business Impact Analysis (BIA). It identifies which processes are critical to the company, what damage would result from a failure, and the maximum duration for which a process may be interrupted. Only on this basis can meaningful priorities be set, because not every resource warrants the same level of protection. The BIA is also the cornerstone of business continuity management and provides the benchmarks against which future emergency plans are evaluated. The BSI Standard 200-4, issued by the Federal Office for Information Security, offers practical guidance on this topic.
Track dependencies and keep them up to date
In the second step, the resources required for each critical process are identified and their dependencies documented. Workshops with process owners have proven effective, supplemented by information from the asset inventory, service provider directory, and IT architecture. It is important not to view the results as a one-time project. Organizations change, new cloud services are added, and personnel come and go. Effective resource planning is therefore integrated into the regular ISMS cycle and reviewed during management reviews, internal audits, and exercises. Emergency drills, in particular, often reveal dependencies that do not appear in any documentation, thereby strengthening resilience in the long term.
At Syngenity, we guide companies through this very process: from business impact analysis, through resource planning and dependency analysis, to the implementation and auditing of an ISMS, as well as the development of business continuity management and resilience programs.
Conclusion: Resource planning is a strategic skill
Resource planning is much more than just a routine operational task. It answers the question of what a company fundamentally depends on, thereby laying the foundation for effective business continuity and robust resilience. ISO 27001 embeds this concept both in the management system sections and in specific controls such as A.5.29 and A.5.30.
Companies that understand their resources and dependencies can identify single points of failure early on, restore operations more quickly after disruptions, and make investment decisions based on real risks. Those who wait until a crisis strikes to look for answers, on the other hand, usually pay the highest price. The best time to start resource planning is therefore always before the next disruption.
